CVE-2025-22150
mediumpriority · track · 0OT risk · elevatedEPSS 0.008 · 56 %ileDEEUUSEPSS · scored 2026-10-27
Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (28)
Products and version ranges known to be affected.
- IBM Business Automation Workflow V24.0.0-V24.0.1all versionscert_bundDEcpe:/a:ibm:business_automation_workflow:v24.0.0_-_v24.0.1
- Red Hat Enterprise Linux Developer Hub 1all versionscert_bundDEcpe:/o:redhat:enterprise_linux:developer_hub_1
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-0156Node.js: Mehrere SchwachstellenDeutsch2025-01-21csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben, einen Denial-of-Service-Zustand herbeizuführen oder nicht näher spezifizierte Angriffe zu starten.
- GHSA-c76h-2ccp-4975Use of Insufficiently Random Values in undici2025-01-21ghsa · osvUS
### Impact [Undici `fetch()` uses Math.random()](https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113) to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, An attacker can tamper with the requests going to the backend APIs if certain conditions are met. ### Patches This is fixed in 5.28.5; 6.21.1; 7.2.3. ### Workarounds Do not issue multipart requests to attacker controlled servers. ### References * https://hackerone.com/reports/2913312 * https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (23)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-22150cnnvd
- https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7fcnnvd
- https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113cnnvd
- https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0cnnvd
- https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934acnnvd
- https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385cnnvd
- https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975cnnvd
- https://hackerone.com/reports/2913312cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan