Skip to content

fix(deps): update dependency uuid to v14 [security]#12418

Open
renovate[bot] wants to merge 2 commits intodevelopfrom
renovate/npm-uuid-vulnerability
Open

fix(deps): update dependency uuid to v14 [security]#12418
renovate[bot] wants to merge 2 commits intodevelopfrom
renovate/npm-uuid-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 23, 2026

This PR contains the following updates:

Package Change Age Confidence
uuid ^3.3.2 → ^14.0.0 age confidence
uuid ^9.0.0 → ^14.0.0 age confidence
uuid ^3.2.1 → ^14.0.0 age confidence

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

GHSA-w5hq-g745-h8pq

More information

Details

Summary

v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset).
By contrast, v4, v1, and v7 explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Affected code
  • src/v35.ts (v3/v5 path) writes buf[offset + i] without bounds validation.
  • src/v6.ts writes buf[offset + i] without bounds validation.
Reproducible PoC
cd /home/StrawHat/uuid
npm ci
npm run build

node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
  ['v4',()=>v4({},new Uint8Array(8),4)],
  ['v5',()=>v5('x',ns,new Uint8Array(8),4)],
  ['v6',()=>v6({},new Uint8Array(8),4)],
]) {
  try { fn(); console.log(name,'NO_THROW'); }
  catch(e){ console.log(name,'THREW',e.name); }
}"

Observed:

  • v4 THREW RangeError
  • v5 NO_THROW
  • v6 NO_THROW

Example partial overwrite evidence captured during audit:

same true buf [
  170, 170, 170, 170,
   75, 224, 100,  63
]
v6 [
  187, 187, 187, 187,
   31,  19, 185,  64
]
Security impact
  • Primary: integrity/robustness issue (silent partial output).
  • If an application assumes full UUID writes into preallocated buffers, this can produce malformed/truncated/partially stale identifiers without error.
  • In systems where caller-controlled offsets/buffer sizes are exposed indirectly, this may become a security-relevant logic flaw.
Suggested fix

Add the same guard used by v4/v1/v7:

if (offset < 0 || offset + 16 > buf.length) {
  throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);
}

Apply to:

  • src/v35.ts (covers v3 and v5)
  • src/v6.ts

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uuidjs/uuid (uuid)

v14.0.0

Compare Source

Security
  • Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.
⚠ BREAKING CHANGES
  • crypto is now expected to be globally defined (requires node@​20+) (#​935)
  • drop node@​18 support (#​934)
  • upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

v13.0.0

Compare Source

⚠ BREAKING CHANGES
  • make browser exports the default (#​901)
Bug Fixes

v12.0.0

Compare Source

⚠ BREAKING CHANGES
  • update to typescript@​5.2 (#​887)
  • remove CommonJS support (#​886)
  • drop node@​16 support (#​883)
Features
Bug Fixes

v11.1.0

Compare Source

Features
  • update TS types to allowUint8Array subtypes for buffer option (#​865) (a5231e7)

v11.0.5

Compare Source

Bug Fixes

v11.0.4

Compare Source

Bug Fixes

v11.0.3

Compare Source

Bug Fixes

v11.0.2

Compare Source

Bug Fixes

v11.0.1

Compare Source

Bug Fixes

v11.0.0

Compare Source

⚠ BREAKING CHANGES
  • refactor v1 internal state and options logic (#​780)
  • refactor v7 internal state and options logic, fixes #​764 (#​779)
  • Port to TypeScript, closes #​762 (#​763)
  • update node support matrix (only support node 16-20) (#​750)
Features
Bug Fixes

v10.0.0

Compare Source

⚠ BREAKING CHANGES
  • update node support (drop node@​12, node@​14, add node@​20) (#​750)
Features
Bug Fixes

v9.0.1

Compare Source

build
  • Fix CI to work with Node.js 20.x

v9.0.0

Compare Source

⚠ BREAKING CHANGES

  • Drop Node.js 10.x support. This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.

  • Remove the minified UMD build from the package.

    Minified code is hard to audit and since this is a widely used library it seems more appropriate nowadays to optimize for auditability than to ship a legacy module format that, at best, serves educational purposes nowadays.

    For production browser use cases, users should be using a bundler. For educational purposes, today's online sandboxes like replit.com offer convenient ways to load npm modules, so the use case for UMD through repos like UNPKG or jsDelivr has largely vanished.

  • Drop IE 11 and Safari 10 support. Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.

    This also removes the fallback on msCrypto instead of the crypto API.

    Browser tests are run in the first supported version of each supported browser and in the latest (as of this commit) version available on Browserstack.

Features
Bug Fixes
build
8.3.2 (2020-12-08)
Bug Fixes
8.3.1 (2020-10-04)
Bug Fixes

v8.3.2

Compare Source

⚠ BREAKING CHANGES

  • Drop Node.js 10.x support. This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.

  • Remove the minified UMD build from the package.

    Minified code is hard to audit and since this is a widely used library it seems more appropriate nowadays to optimize for auditability than to ship a legacy module format that, at best, serves educational purposes nowadays.

    For production browser use cases, users should be using a bundler. For educational purposes, today's online sandboxes like replit.com offer convenient ways to load npm modules, so the use case for UMD through repos like UNPKG or jsDelivr has largely vanished.

  • Drop IE 11 and Safari 10 support. Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.

    This also removes the fallback on msCrypto instead of the crypto API.

    Browser tests are run in the first supported version of each supported browser and in the latest (as of this commit) version available on Browserstack.

Features
Bug Fixes
build
8.3.2 (2020-12-08)
Bug Fixes
8.3.1 (2020-10-04)
Bug Fixes

v8.3.1

Compare Source

⚠ BREAKING CHANGES

  • Drop Node.js 10.x support. This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.

  • Remove the minified UMD build from the package.

    Minified code is hard to audit and since this is a widely used library it seems more appropriate nowadays to optimize for auditability than to ship a legacy module format that, at best, serves educational purposes nowadays.

    For production browser use cases, users should be using a bundler. For educational purposes, today's online sandboxes like replit.com offer convenient ways to load npm modules, so the use case for UMD through repos like UNPKG or jsDelivr has largely vanished.

  • Drop IE 11 and Safari 10 support. Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.

    This also removes the fallback on msCrypto instead of the crypto API.

    Browser tests are run in the first supported version of each supported browser and in the latest (as of this commit) version available on Browserstack.

Features
Bug Fixes
build
8.3.2 (2020-12-08)
Bug Fixes
8.3.1 (2020-10-04)
Bug Fixes

v8.3.0

Compare Source

⚠ BREAKING CHANGES

  • Drop Node.js 10.x support. This library always aims at supporting one EOLed LTS release which by this time now is 12.x which has reached EOL 30 Apr 2022.

  • Remove the minified UMD build from the package.

    Minified code is hard to audit and since this is a widely used library it seems more appropriate nowadays to optimize for auditability than to ship a legacy module format that, at best, serves educational purposes nowadays.

    For production browser use cases, users should be using a bundler. For educational purposes, today's online sandboxes like replit.com offer convenient ways to load npm modules, so the use case for UMD through repos like UNPKG or jsDelivr has largely vanished.

  • Drop IE 11 and Safari 10 support. Drop support for browsers that don't correctly implement const/let and default arguments, and no longer transpile the browser build to ES2015.

    This also removes the fallback on msCrypto instead of the crypto API.

    Browser tests are run in the first supported version of each supported browser and in the latest (as of this commit) version available on Browserstack.

Features
Bug Fixes
build
8.3.2 (2020-12-08)
Bug Fixes
8.3.1 (2020-10-04)
Bug Fixes

v8.2.0

Compare Source

Features
Bug Fixes

v8.1.0

Compare Source

Features
Bug Fixes

v8.0.0

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v7.0.3

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v7.0.2

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v7.0.1

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

v7.0.0

Compare Source

⚠ BREAKING CHANGES

  • For native ECMAScript Module (ESM) usage in Node.js only named exports are exposed, there is no more default export.

    -import uuid from 'uuid';
-console.log(uuid.v4()); // -> 'cd6c3b08-0adc-4f4b-a6ef-36087a1c9869'
+import { v4 as uuidv4 } from 'uuid';
+uuidv4(); // ⇨ '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'

  • Deep requiring specific algorithms of this library like require('uuid/v4'), which has been deprecated in uuid@7, is no longer supported.

    Instead use the named exports that this module exports.

    For ECMAScript Modules (ESM):

    -import uuidv4 from 'uuid/v4';
+import { v4 as uuidv4 } from 'uuid';
uuidv4();

    For CommonJS:

    -const uuidv4 = require('uuid/v4');
+const { v4: uuidv4 } = require('uuid');
uuidv4();
Features
Bug Fixes
  • add CommonJS syntax example to README quickstart section (#​417) (e0ec840)
7.0.3 (2020-03-31)
Bug Fixes
7.0.2 (2020-03-04)
Bug Fixes
7.0.1 (2020-02-25)
Bug Fixes

Configuration

📅 Schedule: (in timezone Europe/London)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the Security label Apr 23, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 23, 2026

Oops! Looks like you forgot to update the changelog. When updating CHANGELOG.md, please consider the following:

  • Changelog is read by country implementors who might not always be familiar with all technical details of OpenCRVS. Keep language high-level, user friendly and avoid technical references to internals.
  • Answer "What's new?", "Why was the change made?" and "Why should I care?" for each change.
  • If it's a breaking change, include a migration guide answering "What do I need to do to upgrade?".

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 23, 2026 •
edited
Loading

ℹ️ Coverage metrics explained:
• Statements — Executed code statements (basic logic lines)
• Branches — Tested decision paths (if/else, switch, ternaries)
• Functions — Functions invoked during tests
• Lines — Source lines executed

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 23, 2026 •
edited
Loading

📊 events test coverage

Statements: 85.5%
Branches:   83.93%
Functions:  90.78%
Lines:      85.5%
Updated at: Mon, 27 Apr 2026 07:02:05 GMT

@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented Apr 27, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rikukissa