DirectorySecurity AdvisoriesPricing
Sign in
Security Advisories

CGA-xw57-mvrc-chrm

Package

gitlab-rails-ce-19.3

Component

uuid

Latest update

Fixed

Fixed version

19.3.1-r6

Aliases

Severity

Unknown
Eliminate CVEs with Chainguard hardened images

Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.

Start for free

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-41907

Updates

Status

Fixed

Fixed version

19.3.1-r6

Status

Pending upstream fix

Impact

uuid 10.0.0 is a transitive dependency of @snowplow/browser-tracker-core and @snowplow/tracker-core 4.6.8, bundled into GitLab's frontend assets (srv/gitlab/yarn.lock). The only fixed release is uuid 11.1.1, whose browser build uses optional-chaining syntax that GitLab's webpack 4 asset pipeline cannot parse: forcing uuid 11.1.1 via yarn resolutions fails gitlab:assets:compile with 'Module parse failed: Unexpected token' in uuid/dist/esm-browser/*.js (verified 2026-09-02). Resolution requires upstream GitLab to move the asset pipeline off webpack 4, or snowplow to ship a build compatible with it.

Status

Under investigation


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.