Executive Summary
CVE-2026-106074 is a defect in the Node.js crypto module where the internal entropy caches backing crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() are serialized into user-land startup snapshots and single executable applications, causing every process launched from an affected snapshot to return identical values until the cache refills. The physical criticality is deterministic identifier collision: up to 127 duplicate UUIDs and roughly 1,000 duplicate randomInt() values per process, which breaks uniqueness guarantees relied on by edge gateways, historians, and application-layer authentication running on Node.js runtimes.
Technical Exposure Breakdown
The root cause is the interaction between the snapshot mechanism (--build-snapshot and the useSnapshot single executable application path) and the entropy caching inside the crypto subsystem. If any of the affected functions, or a higher-level API that depends on them such as URL.createObjectURL(), is invoked during snapshot construction, the pre-filled pool of random bytes is captured as static state. That state is then reused verbatim by every process instantiated from the snapshot.
This is a determinism defect, not a cryptographic break of the underlying generator. The entropy source itself is sound. The flaw is that the cache crosses the trust boundary of the build step and is replayed at runtime. The practical effect: the first N calls after process start return predictable, duplicated output. For randomUUID() the window is about 127 values; for randomInt() it is roughly 1,000 values before the pool is refilled from the real source. The CVSS score is 4.8, consistent with a defect that requires a specific build configuration and does not yield direct remote code execution. It is not listed in the known exploited vulnerability catalog. Patch status is unknown at the time of this writing.
Exploitability is conditional. The vulnerability only manifests when an application is deliberately built with snapshots and when the affected functions execute during the snapshot phase. Many OT deployments package Node.js services precisely this way to reduce cold start time on constrained edge hardware, which is where the exposure concentrates.
OT Impact and Compliance Risk
In an industrial environment, duplicated identifiers do not stay cosmetic. Edge collectors and protocol gateways frequently generate UUIDs for message correlation, transaction tracking, and event deduplication against a historian. If two gateways built from the same snapshot emit colliding UUIDs, downstream systems may silently drop events as duplicates or misattribute readings to the wrong asset. In a water or pipeline SCADA context, a dropped or merged telemetry event is a loss of situational awareness, not a trivial bug.
Where randomInt() or randomUUIDv7() feed session tokens, nonce generation, or temporary credential issuance in an application-layer service, predictable output degrades the authentication boundary. This is relevant to IEC 62443-4-1 secure development expectations and the -3-3 system requirements for identification and authentication. For regulated operators, deterministic token generation can constitute a weak authenticator finding under TSA SD-02C for pipeline and rail, and intersects AWIA 2018 risk and resilience obligations for water utilities whose application identifiers are used for integrity tracking. NERC CIP-007 and CIP-010 configuration management apply where the snapshot build artifact is the controlled baseline that now carries frozen entropy.
Compensating Controls
Do not rely solely on a vendor runtime update. First, audit every Node.js single executable application and snapshot-based service in your OT footprint and determine whether the affected crypto functions execute during the build phase. The fastest structural fix is to defer all entropy-consuming calls until after process start, never inside snapshot initialization, and to force a cache refresh at runtime before the first identifier is issued.
Where a rebuild is not immediately possible, treat affected services as if their identifiers are non-unique. Add a server-side uniqueness check at the historian or message broker that rejects or reseeds colliding identifiers rather than trusting the client. For token issuance paths, move random generation to a hardware-backed or OS-level source outside the snapshot scope.
Network detection is weak here because the defect produces valid-looking traffic. A Suricata rule concept is limited to flagging anomalous volumes of identical UUID strings seen across distinct source hosts in application-layer logs, which is a behavioral signal rather than a signature. Do not launch active scanning against snapshot-packaged edge devices to enumerate versions; probing constrained industrial components can hang or brick them. Prefer passive inventory and build-pipeline inspection.
BreachSpider Intel
BreachSpider tracks CVE-2026-106074 and related runtime determinism defects across OT application stacks so operators can monitor exposure without active scanning of production control systems.