CVE-2026-106074

CVE-2026-106074 is a vulnerability in Node.js that affects applications utilizing startup snapshots or single-executable applications (SEAs). The issue stems from the entropy caches used by the `crypto.randomUUID()` and `randomInt()` functions. When an application is built as a startup snapshot or a single-executable application, these entropy caches can be preserved and saved directly into the snapshot. Because the cached randomness is frozen into the application, multiple processes spawned from the same snapshot or executable will repeat the exact same "random" values. This behavior undermines security mechanisms and application logic that rely on these values being unpredictable. To resolve the issue, Node.js has been updated to reset these caches across snapshots, and developers are advised to upgrade their Node.js runtime and rebuild any affected single-executable applications or startup snapshots.