Skip to content

Bump uuid version due to https://github.com/advisories/GHSA-w5hq-g745-h8pq #30

@jeck5895

Description

@jeck5895

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
Description
v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). By contrast, v4, v1, and v7 explicitly throw RangeError on invalid bounds.

This inconsistency allows silent partial writes into caller-provided buffers.

Links
GHSA-w5hq-g745-h8pq
https://github.com/uuidjs/uuid
uuidjs/uuid@3d2c5b0
https://github.com/uuidjs/uuid/releases/tag/v14.0.0
GHSA-w5hq-g745-h8pq

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions