{
  "fix": "DEBIAN-CVE-2026-106074",
  "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-106074",
  "summary": "DEBIAN-CVE-2026-106074, released November 11, 2026, fixes 1 CVE in nodejs (version 24.22.1\u002Bdfsg\u002B~cs24.19.2-1). None of them is reported as exploited. Patch Radar priority: High.",
  "platform": "linux",
  "type": "advisory",
  "title": "nodejs security update",
  "released": "2026-11-11T00:24:45Z",
  "priority": "High",
  "priorityTier": 3,
  "priorityReason": "Closes CVE-2026-106074, high severity",
  "supported": true,
  "cveCount": 1,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.00334,
  "maxCvss": 8.1,
  "vendorAdvisory": "https://security-tracker.debian.org/tracker/CVE-2026-106074",
  "appliesTo": [
    {
      "product": "nodejs",
      "productUrl": "https://patchblox.com/security/product/linux/nodejs",
      "release": "Debian 14",
      "fixedVersion": "24.22.1\u002Bdfsg\u002B~cs24.19.2-1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2026-106074",
      "url": "https://patchblox.com/security/cve/CVE-2026-106074",
      "title": "A flaw in Node.js \u0060crypto\u0060 causes the internal entropy caches used by \u0060crypto.randomUUID()\u0060, \u0060crypto.randomUUIDv7()\u0060, and \u0060crypto.randomInt()\u0060 to be saved into user-land startup snapshots (\u0060--build-snapshot\u0060) and single executable applications built with \u0060useSnapshot\u0060.\n\nIf any of these functions, or an API that relies on them such as \u0060URL.createObjectURL()\u0060, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 \u0060randomInt()\u0060 values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",
      "priority": "High",
      "severity": "Moderate",
      "cvss": 8.1,
      "epss": 0.00334,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-11T07:45:43Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}