CVE-2026-41907: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41907 is a missing buffer bounds check vulnerability in the uuidjs/uuid npm library affecting the v3(), v5(), and v6() UUID generation methods. Prior to the patched releases, these methods accept external output buffers but do not validate whether the write offset and buffer size are within bounds, allowing silent partial writes into caller-provided buffers. The vulnerability was published on April 24, 2026, and affects uuid versions prior to 11.1.1, as well as versions 12.0.0 and 13.0.0. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.1 (High) (GitHub Advisory, IBM Advisory).

The root cause is classified as CWE-787 (Out-of-bounds Write) and CWE-823 (Use of Out-of-range Pointer Offset). In src/v35.ts (covering v3() and v5()) and src/v6.ts, UUID bytes are written via buf[offset + i] without any validation that the offset is non-negative or that offset + 16 does not exceed buf.length. By contrast, v4(), v1(), and v7() explicitly throw a RangeError on invalid bounds, making this an inconsistency in the API's defensive coding. An attacker or misconfigured caller can supply a small buffer or a large offset, causing the library to silently write partial UUID data beyond the intended buffer boundary into adjacent memory regions. A public PoC demonstrates the issue by calling v5('x', ns, new Uint8Array(8), 4) and v6({}, new Uint8Array(8), 4), both of which return without throwing, while v4() correctly throws a RangeError (GitHub Advisory).

The primary impact is an integrity and robustness issue: applications that assume full UUID writes into preallocated buffers may produce malformed, truncated, or partially stale identifiers without any error signal. In scenarios where caller-controlled offsets or buffer sizes are exposed indirectly (e.g., through network input or user-supplied parameters), this silent out-of-bounds write can corrupt adjacent memory regions, potentially overwriting critical data structures or application state. Downstream IBM products incorporating the vulnerable uuid library — including IBM Voice Gateway, Tivoli Netcool/OMNIbus, Business Automation Manager Open Editions, Maximo Application Suite, and InfoSphere Optim Archive Viewer — are all exposed to this integrity risk (GitHub Advisory, IBM Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, demonstrating the missing bounds check by invoking v5() and v6() with out-of-range parameters and confirming they do not throw RangeError. The EPSS score is approximately 0.042%, indicating a low probability of widespread exploitation in the near term. There is no evidence of active in-the-wild exploitation at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The exploit maturity is rated as "Unreported" in CVSS v4.0 scoring (GitHub Advisory).

1. Identify vulnerable dependency: Determine whether the target application uses the uuid npm package at a version below 11.1.1, or at versions 12.0.0 or 13.0.0, by inspecting package.json or package-lock.json.
2. Locate buffer-accepting call sites: Find code paths in the application that call v3(), v5(), or v6() with an externally supplied or attacker-influenced buf argument and/or offset parameter.
3. Craft out-of-range parameters: Supply a Uint8Array buffer smaller than 16 bytes (e.g., 8 bytes) combined with an offset that causes offset + 16 to exceed buf.length (e.g., offset = 4 with an 8-byte buffer).
4. Trigger silent partial write: Invoke the vulnerable function — e.g., v5('x', ns, new Uint8Array(8), 4) — which writes UUID bytes beyond the buffer boundary without throwing an error, corrupting adjacent memory.
5. Observe or leverage memory corruption: Depending on the runtime environment and application logic, the adjacent memory overwrite may corrupt data structures, cause logic errors, or produce malformed identifiers that bypass downstream validation (GitHub Advisory).

The vulnerability is fixed in uuid versions 11.1.1, 12.0.1, and 13.0.1 for the npm package. The fix adds the same bounds guard used by v4()/v1()/v7(): if (offset < 0 || offset + 16 > buf.length) { throw new RangeError(...); } applied to src/v35.ts and src/v6.ts. Organizations should update the uuid dependency to a patched version immediately. IBM has released product-specific security bulletins for affected products including Voice Gateway, Tivoli Netcool/OMNIbus GUI, Business Automation Manager Open Editions, Maximo Application Suite (including Manage and Visual Inspection components), InfoSphere Optim Archive Viewer, and Consulting Advantage for Cybersecurity — customers should apply the relevant IBM patches (GitHub Advisory, IBM Voice Gateway, IBM TDI, IBM Maximo).

IBM issued multiple security bulletins across its product portfolio acknowledging the vulnerability and directing customers to apply patches, covering products such as Voice Gateway, Tivoli Netcool/OMNIbus, Maximo Application Suite, and InfoSphere Optim Archive Viewer. The vulnerability was reported to the uuidjs project by security researcher 0xStraw-Hat and disclosed via GitHub's coordinated security advisory process. Community reaction has been measured, with the issue noted as a moderate-severity API inconsistency rather than a critical remote code execution flaw (GitHub Advisory, IBM Advisory).