CVE-2025-22150: Undici Uses Insufficiently Random Values
Impact
Undici fetch() uses Math.random() to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known.
If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, An attacker can tamper with the requests going to the backend APIs if certain conditions are met.
Patches
This is fixed in 5.28.5; 6.21.1; 7.2.3.
Workarounds
Do not issue multipart requests to attacker controlled servers.
References
https://hackerone.com/reports/2913312 https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f
Other sources
Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses Math.random() to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.
— NVD
Undici Uses Insufficiently Random Values
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22150?
CVE-2025-22150 has a severity level that denotes potential risks associated with predictable boundaries in multipart/form-data requests.
How do I fix CVE-2025-22150?
To fix CVE-2025-22150, update the Undici package to version 7.2.3, 6.21.1, or 5.28.5.
What versions are affected by CVE-2025-22150?
CVE-2025-22150 affects Undici versions from 4.5.0 to 7.2.3, including several intermediary versions.
What issue does CVE-2025-22150 highlight regarding randomness?
CVE-2025-22150 highlights that the use of Math.random() in Undici can lead to predictable values, which may compromise security.
Is CVE-2025-22150 specific to a programming language?
Yes, CVE-2025-22150 specifically affects the Node.js ecosystem where the Undici package is utilized for HTTP requests.