CVE-2026-106074Vulnerability
Reported by 2 independent sources · first reported by The Hacker News · last reported
Last reported yesterday
What the reports say
2 reports, newest first · the exact sentence from each-
Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do“CVE-2026-106074 (Medium, crypto): Cached values for crypto.randomUUID and crypto.randomInt were stored in startup snapshots, causing processes that initiated from the same snapshot to produce identical initial values.”
-
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions“…) hand back the same values in every process when an application is built as a startup snapshot or a single-executable application (CVE-2026-106074), which undermines anything that relies on those values being unpredictable.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-106069, CVE-2026-105483, CVE-2026-105482, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073
Thanks — we review every report.