Description
uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.
Affected products
uuidjs: uuid
References3
- github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq ExploitVendor Advisory
- github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq ExploitVendor Advisory
- github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e… Patch
Metrics
- CVSS 3.1
-
2.5
LOW
Score source: NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - EPSS — exploit probability
- 0% percentile: 8 · as of 13 November 2026
- CWE
- CWE-670
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.