Skip to content

fix(deps): update dependency uuid to v11 [security]#3916

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate-npm-uuid-vulnerability
Open

fix(deps): update dependency uuid to v11 [security]#3916
renovate[bot] wants to merge 1 commit into
mainfrom
renovate-npm-uuid-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 3, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
uuid ^9.0.1 → ^11.0.0 age confidence

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq

More information

Details

Summary

v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4, v1, and v7 explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code
  • src/v35.ts (v3/v5 path) writes buf[offset + i] without bounds validation.
  • src/v6.ts writes buf[offset + i] without bounds validation.
Reproducible PoC
cd /home/StrawHat/uuid
npm ci
npm run build

node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
  ['v4',()=>v4({},new Uint8Array(8),4)],
  ['v5',()=>v5('x',ns,new Uint8Array(8),4)],
  ['v6',()=>v6({},new Uint8Array(8),4)],
]) {
  try { fn(); console.log(name,'NO_THROW'); }
  catch(e){ console.log(name,'THREW',e.name); }
}"

Observed:

  • v4 THREW RangeError
  • v5 NO_THROW
  • v6 NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
  170, 170, 170, 170,
   75, 224, 100,  63
]
v6 [
  187, 187, 187, 187,
   31,  19, 185,  64
]
Security impact
  • Primary: integrity/robustness issue (silent partial output).
  • If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
  • In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.
Suggested fix

Add the same guard used by v4/v1/v7:

if (offset < 0 || offset + 16 > buf.length) {
  throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);
}

Apply to:

  • src/v35.ts (covers v3 and v5)
  • src/v6.ts

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

v11.1.1

Compare Source

v11.1.0

Compare Source

Features
  • update TS types to allowUint8Array subtypes for buffer option (#​865) (a5231e7)

v11.0.5

Compare Source

Bug Fixes

v11.0.4

Compare Source

Bug Fixes

v11.0.3

Compare Source

Bug Fixes

v11.0.2

Compare Source

Bug Fixes

v11.0.1

Compare Source

Bug Fixes

v11.0.0

Compare Source

⚠ BREAKING CHANGES
  • refactor v1 internal state and options logic (#​780)
  • refactor v7 internal state and options logic, fixes #​764 (#​779)
  • Port to TypeScript, closes #​762 (#​763)
  • update node support matrix (only support node 16-20) (#​750)
Features
Bug Fixes

v10.0.0

Compare Source

⚠ BREAKING CHANGES
  • update node support (drop node@​12, node@​14, add node@​20) (#​750)
Features
Bug Fixes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency label May 3, 2026
@netlify
Copy link
Copy Markdown

netlify Bot commented May 3, 2026 •
edited
Loading

✅ Deploy Preview for brilliant-pasca-3e80ec canceled.

Name Link
🔨 Latest commit 353147e
🔍 Latest deploy log https://app.netlify.com/projects/brilliant-pasca-3e80ec/deploys/69ffc862a7ff4c0008f1b532

@github-actions github-actions Bot added type: tests Testing related pkg: backend Changes in the backend package. pkg: frontend Changes in the frontend package. pkg: auth Changes in the GNAP auth package. pkg: mock-ase pkg: mock-account-service-lib labels May 3, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 3, 2026 •
edited
Loading

🚀 Performance Test Results

Test Configuration:

  • VUs: 4
  • Duration: 1m0s

Test Metrics:

  • Requests/s: 48.38
  • Iterations/s: 16.12
  • Failed Requests: 0.00% (0 of 2908)
📜 Logs 

> performance@1.0.0 run-tests:testenv /home/runner/work/rafiki/rafiki/test/performance
> ./scripts/run-tests.sh -e test -k -q --vus 4 --duration 1m

Cloud Nine GraphQL API is up: http://localhost:3101/graphql
Cloud Nine Wallet Address is up: http://localhost:3100/
Happy Life Bank Address is up: http://localhost:4100/
cloud-nine-wallet-test-backend already set
cloud-nine-wallet-test-auth already set
happy-life-bank-test-backend already set
happy-life-bank-test-auth already set
     data_received..................: 1.0 MB 18 kB/s
     data_sent......................: 2.2 MB 37 kB/s
     http_req_blocked...............: avg=7.07µs   min=2.39µs   med=5.32µs   max=848.62µs p(90)=6.44µs   p(95)=7.13µs  
     http_req_connecting............: avg=405ns    min=0s       med=0s       max=534.26µs p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=82.05ms  min=8.16ms   med=65.47ms  max=443.2ms  p(90)=140.01ms p(95)=168.74ms
       { expected_response:true }...: avg=82.05ms  min=8.16ms   med=65.47ms  max=443.2ms  p(90)=140.01ms p(95)=168.74ms
     http_req_failed................: 0.00%  ✓ 0         ✗ 2908
     http_req_receiving.............: avg=89.76µs  min=24.49µs  med=80.55µs  max=1.29ms   p(90)=117.12µs p(95)=151.73µs
     http_req_sending...............: avg=37.86µs  min=9.55µs   med=29.02µs  max=9.21ms   p(90)=40.91µs  p(95)=56.33µs 
     http_req_tls_handshaking.......: avg=0s       min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=81.92ms  min=7.96ms   med=65.34ms  max=443.12ms p(90)=139.9ms  p(95)=168.62ms
     http_reqs......................: 2908   48.376143/s
     iteration_duration.............: avg=247.89ms min=169.05ms med=235.27ms max=933.52ms p(90)=304.86ms p(95)=338.72ms
     iterations.....................: 969    16.119836/s
     vus............................: 4      min=4       max=4 
     vus_max........................: 4      min=4       max=4

@renovate renovate Bot force-pushed the renovate-npm-uuid-vulnerability branch from 8774449 to 353147e Compare May 9, 2026 23:50
@renovate renovate Bot changed the title fix(deps): update dependency uuid to v14 [security] fix(deps): update dependency uuid to v11 [security] May 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency pkg: auth Changes in the GNAP auth package. pkg: backend Changes in the backend package. pkg: frontend Changes in the frontend package. pkg: mock-account-service-lib pkg: mock-ase type: tests Testing related

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants