~ / search / GHSA-265q-28rp-chq5

GHSA-265q-28rp-chq5

Insecure Entropy Source - Math.random() in node-uuid

Source: GitHub Advisory Database (reviewed) High CVE-2015-8851

Packages

EcosystemPackageAffectedFixed in
npm node-uuid < 1.4.4 1.4.4

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of `node-uuid` consistently fall back to using `Math.random` as an entropy source instead of `crypto`, which may result in guessable UUID's. ## Recommendation Update to version 1.4.4 or later.

References

External links from the advisory. They lead to third-party sites.