CVE-2025-22150
Undici Uses Insufficiently Random Values
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.
A flaw was found in the undici package for Node.js. Undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If an app has a mechanism that sends multipart requests to an attacker-controlled website, it can leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met.
An update for the nodejs:20 module is now available for Red Hat Enterprise Linux 8. Issues addressed include a memory leak vulnerability.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-12-30 CVE Reserved
- 2025-01-21 CVE Published
- 2025-02-12 CVE Updated
- 2025-04-02 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-330: Use of Insufficiently Random Values
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f | X_refsource_misc | |
| https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113 | X_refsource_misc | |
| https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0 | X_refsource_misc | |
| https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a | X_refsource_misc | |
| https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385 | X_refsource_misc | |
| https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975 | X_refsource_confirm | |
| https://hackerone.com/reports/2913312 | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2025-22150 | 2025-03-31 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2339176 | 2025-03-31 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Nodejs Search vendor "Nodejs" | Undici Search vendor "Nodejs" for product "Undici" | >= 4.5.0 < 5.28.5 Search vendor "Nodejs" for product "Undici" and version " >= 4.5.0 < 5.28.5" | en |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Undici Search vendor "Nodejs" for product "Undici" | >= 6.0.0 < 6.21.1 Search vendor "Nodejs" for product "Undici" and version " >= 6.0.0 < 6.21.1" | en |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Undici Search vendor "Nodejs" for product "Undici" | >= 7.0.0 < 7.2.3 Search vendor "Nodejs" for product "Undici" and version " >= 7.0.0 < 7.2.3" | en |
Affected
| ||||||