uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.
| Vendor | Product | Versions |
|---|---|---|
| uuid | uuid | npm/uuid: >= 12.0.0, < 12.0.1, npm/uuid: >= 13.0.0, < 13.0.1, npm/uuid: < 11.1.1 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| ibm | app connect enterprise | cert_advisory | 90% |
| npm | uuid | GHSA | 85% |
Updated severity to CRITICAL, noted that the vulnerability affects uuidjs uuid up to 13.x, and changed exploit availability to false.
Initial creation
