---
id: CVE-2026-41988
title: >-
  uuid before 14.0.0 can make unexpected writes when external output buffers are
  used, and the UUID version is 3, 5, or 6
summary: >-
  uuid before 14.0.0 can make unexpected writes when external output buffers are
  used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which
  is very commonly used, is unaffected by this issue.
severity: low
cvss: 3.2
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N'
cwe:
  - CWE-670
vendor: uuidjs
product: uuid
affected:
  - uuid < 11.1.1
  - uuid = 12.0.0
  - uuid = 13.0.0
patched:
  - uuid 11.1.1
published: '2026-04-23'
updated: '2026-07-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41988'
references:
  - url: >-
      https://github.com/uuidjs/uuid/commit/3d2c5b0342f0fcb52a5ac681c3d47c13e7444b34
    label: cve@mitre.org
  - url: 'https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq'
    label: cve@mitre.org
  - url: 'https://github.com/uuidjs/uuid/security/advisories/GHSA-w5hq-g745-h8pq'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.0013
epssPercentile: 0.0216
ingestedAt: '2026-07-08T03:46:38.664Z'
---

## Overview

uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.

## Affected

- `uuid < 11.1.1`
- `uuid = 12.0.0`
- `uuid = 13.0.0`

## Remediation

Upgrade past the affected range:

- `uuid 11.1.1`