Skip to content

Update dependency uuid to v11.1.1 [SECURITY] - #5637

Merged
obenland merged 1 commit into
mainfrom
gha-renovatenpm-uuid-vulnerability
Oct 13, 2026
Merged

Update dependency uuid to v11.1.1 [SECURITY]#5637
obenland merged 1 commit into
mainfrom
gha-renovatenpm-uuid-vulnerability

Conversation

@openverse-bot

@openverse-bot openverse-bot commented Oct 13, 2026

Copy link
Copy Markdown
Collaborator

This PR contains the following updates:

Package Change Age Confidence
uuid 11.0.3 → 11.1.1 age confidence

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

CVE-2026-41907 / GHSA-w5hq-g745-h8pq

More information

Details

Summary

The v3(), v5(), and v6() API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4(), v1(), and v7() API methods explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code
  • src/v35.ts (v3()/v5() path) writes buf[offset + i] without bounds validation.
  • src/v6.ts writes buf[offset + i] without bounds validation.
Reproducible PoC
cd /home/StrawHat/uuid
npm ci
npm run build

node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
  ['v4()',()=>v4({},new Uint8Array(8),4)],
  ['v5()',()=>v5('x',ns,new Uint8Array(8),4)],
  ['v6()',()=>v6({},new Uint8Array(8),4)],
]) {
  try { fn(); console.log(name,'NO_THROW'); }
  catch(e){ console.log(name,'THREW',e.name); }
}"

Observed:

  • v4() THREW RangeError
  • v5() NO_THROW
  • v6() NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
  170, 170, 170, 170,
   75, 224, 100,  63
]
v6 [
  187, 187, 187, 187,
   31,  19, 185,  64
]
Security impact
  • Primary: integrity/robustness issue (silent partial output).
  • If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
  • In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.
Suggested fix

Add the same guard used by v4()/v1()/v7():

if (offset < 0 || offset + 16 > buf.length) {
  throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);
}

Apply to:

  • src/v35.ts (covers v3() and v5())
  • src/v6.ts

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

v11.1.1

Compare Source

Bug Fixes

v11.1.0

Compare Source

Features
  • update TS types to allowUint8Array subtypes for buffer option (#​865) (a5231e7)

v11.0.5

Compare Source

Bug Fixes

v11.0.4

Compare Source

Bug Fixes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@openverse-bot
openverse-bot requested a review from a team as a code owner October 13, 2026 14:40
@openverse-bot openverse-bot added dependencies Pull requests that update a dependency file 💻 aspect: code Concerns the software code in the repository 🟨 tech: javascript Involves JavaScript 🟩 priority: low Low priority and doesn't need to be rushed 🧰 goal: internal improvement Improvement that benefits maintainers, not users labels Oct 13, 2026
@openverse-bot
openverse-bot requested a review from krysal October 13, 2026 14:40
@openverse-bot openverse-bot added the 🧱 stack: frontend Related to the Nuxt frontend label Oct 13, 2026
@openverse-bot
openverse-bot requested a review from dhruvkb October 13, 2026 14:40
@openverse-bot openverse-bot moved this to 👀 Needs Review in Openverse PRs Oct 13, 2026
@github-actions

github-actions Bot commented Oct 13, 2026

Copy link
Copy Markdown

Latest k6 run output1

     ✓ status was 200

     checks.........................: 100.00% ✓ 398      ✗ 0   
     data_received..................: 92 MB   383 kB/s
     data_sent......................: 126 kB  526 B/s
     http_req_blocked...............: avg=36.83µs  min=2.24µs   med=4.31µs   max=697.76µs p(90)=141.5µs  p(95)=169.36µs
     http_req_connecting............: avg=23.12µs  min=0s       med=0s       max=618.33µs p(90)=87.59µs  p(95)=110.57µs
     http_req_duration..............: avg=125.72ms min=14.75ms  med=93.12ms  max=750.58ms p(90)=283.1ms  p(95)=334.15ms
       { expected_response:true }...: avg=125.72ms min=14.75ms  med=93.12ms  max=750.58ms p(90)=283.1ms  p(95)=334.15ms
   ✓ http_req_failed................: 0.00%   ✓ 0        ✗ 398 
     http_req_receiving.............: avg=176.3µs  min=71.34µs  med=133.24µs max=2.85ms   p(90)=237.38µs p(95)=300.4µs 
     http_req_sending...............: avg=19.84µs  min=5.98µs   med=18.62µs  max=56.11µs  p(90)=29.21µs  p(95)=34.35µs 
     http_req_tls_handshaking.......: avg=0s       min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=125.52ms min=14.64ms  med=92.99ms  max=750.29ms p(90)=282.9ms  p(95)=333.98ms
     http_reqs......................: 398     1.655307/s
     iteration_duration.............: avg=663.69ms min=270.74ms med=728.33ms max=1.33s    p(90)=868.82ms p(95)=962.66ms
     iterations.....................: 76      0.316089/s
     vus............................: 0       min=0      max=6 
     vus_max........................: 60      min=60     max=60

Footnotes

  1. This comment will automatically update with new output each time k6 runs for this PR ↩

@obenland
obenland merged commit 46454bb into main Oct 13, 2026
81 checks passed
@obenland
obenland deleted the gha-renovatenpm-uuid-vulnerability branch October 13, 2026 14:56
@github-project-automation github-project-automation Bot moved this from 👀 Needs Review to 🤝 Merged in Openverse PRs Oct 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@krysal krysal Awaiting requested review from krysal krysal is a code owner automatically assigned from WordPress/openverse-frontend
@dhruvkb dhruvkb Awaiting requested review from dhruvkb dhruvkb is a code owner automatically assigned from WordPress/openverse-frontend

Assignees

No one assigned

Labels

💻 aspect: code Concerns the software code in the repository dependencies Pull requests that update a dependency file 🧰 goal: internal improvement Improvement that benefits maintainers, not users 🟩 priority: low Low priority and doesn't need to be rushed 🧱 stack: frontend Related to the Nuxt frontend 🟨 tech: javascript Involves JavaScript

Projects

Openverse PRs
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@openverse-bot @obenland