CVE-2025-22150
Undici Uses Insufficiently Random Values
At a glance
- Severity
- MEDIUM 6.8
- EPSS
- EPSS 0.78 % · percentile 56 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Deferred
Description
Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N | GitHub_M |
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N | NVD · security-advisories@github.com (Secondary) |
Weaknesses (CWE)
Advisories
- GHSA-c76h-2ccp-4975 — Use of Insufficiently Random Values in undici
European references
- ENISA EUVD · EUVD-2025-0154
- GCVE · GCVE-0-2025-22150
CERT-FR advisories
- CERTFR-2026-AVI-0327 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0724 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0214 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0170 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| nodejs · undici | affected >= 4.5.0, < 5.28.5 ; affected >= 6.0.0, < 6.21.1 ; affected >= 7.0.0, < 7.2.3 |
References
- https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975
- https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0
- https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a
- https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385
- https://hackerone.com/reports/2913312
- https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f
- https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |