CVE-2026-106074: 
Node.js vulnerability analysis and mitigation

CVE-2026-106074 is a cryptographic flaw in Node.js where random caches are not properly reset across snapshots, resulting in predictable random number generation. The vulnerability is rated Medium severity and was first tracked by Feedly on October 21, 2026 (Feedly). Affected versions span multiple Node.js release lines, with patches issued in v22.23.4, v24.22.1, and v26.12.1 (Node.js v22 Release, Node.js v24 Release, Node.js v26 Release). The CVE status is currently listed as Reserved, and a full CVSS score has not yet been publicly assigned.

The root cause is improper state management of cryptographic random caches across V8 snapshot boundaries in Node.js (CWE-330: Use of Insufficiently Random Values). When a Node.js process is restored from a snapshot, the internal random cache is not reset, causing subsequent calls to random number generation functions to produce predictable outputs derived from the pre-snapshot state. Exploitation requires the ability to trigger or observe snapshot-based process restoration, which is a precondition that limits the attack surface but does not eliminate risk in environments leveraging Node.js startup snapshots for performance optimization (Feedly, Node.js v26 Release).

Successful exploitation allows an attacker to predict cryptographic random outputs generated after a snapshot restore, potentially compromising encryption keys, authentication tokens, session identifiers, or other security-sensitive values that rely on randomness. This could lead to session hijacking, authentication bypass, or decryption of protected data depending on how the affected Node.js application uses random number generation. The impact is bounded to environments using Node.js startup snapshots, but within those environments the confidentiality and integrity of cryptographic operations are at risk (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-106074 as of the available data. The CVE is listed as Reserved and no EPSS score or CISA KEV catalog entry has been identified. Exploitation is constrained by the requirement that the target application uses Node.js snapshot functionality, reducing the overall attack surface (Feedly).

Node.js has released patched versions addressing this vulnerability: v22.23.4, v24.22.1, and v26.12.1. Users should upgrade to the appropriate patched release for their Node.js version line as soon as possible (Node.js v22 Release, Node.js v24 Release, Node.js v26 Release). As a temporary workaround, organizations can disable or avoid the use of Node.js startup snapshots until the patch is applied, which eliminates the precondition for exploitation. Downstream projects such as Apereo CAS have also issued patches incorporating the fix (Apereo CAS Commit).

Security news outlets including CyberSecurityNews and TheDailyTechFeed covered the Node.js security update release, noting the patch addressed multiple issues including TLS, DNS, Brotli, and this cryptographic flaw (CyberSecurityNews, TheDailyTechFeed). No notable individual researcher commentary or significant social media discussion has been identified beyond standard patch announcement coverage.