Critical Vulnerability in Node.js due to Undici's Predictable Randomness
Summary
ALPINE-CVE-2025-22150: Undici is an HTTP/1.1 client. Affects nodejs versions < 22.13.1-r0. Fixed in 22.13.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine, widely used for building scalable network applications. It allows developers to use JavaScript on the server side, enabling the creation of dynamic web applications. The Undici library, an HTTP/1.1 client for Node.js, is designed for making HTTP requests efficiently. However, it has a vulnerability that arises from its use of the Math.random() function to select boundaries for multipart/form-data requests, which can be predicted under certain conditions.
Vulnerability Detail
The vulnerability stems from Undici's implementation of the Math.random() function in versions prior to 5.28.5, 6.21.1, and 7.2.3. This implementation can lead to predictable outputs, allowing attackers to potentially tamper with requests sent to backend APIs if the application sends multipart requests to an attacker-controlled server. The ramifications include unauthorized access and data leakage, making it critical for developers to address this issue promptly.
How To Fix
Minimum fixed version
22.13.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid issuing multipart requests to any servers controlled by attackers. This can help prevent potential exploitation of the vulnerability until the package is updated.
Conclusion
The vulnerability in Node.js due to Undici's use of Math.random() poses significant risks, including potential data leakage and unauthorized access. It is crucial for developers to update their packages to the fixed versions and implement workarounds to mitigate risks until updates can be applied.
See every vulnerability recorded for nodejs →
FAQ
The vulnerability is due to the use of Math.random() in Undici, which can lead to predictable outputs and potential tampering of multipart requests.
Node.js versions using Undici prior to 5.28.5, 6.21.1, and 7.2.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can lead to unauthorized access and data leakage, compromising the integrity of your application.
If an immediate update is not possible, ensure that your application does not send multipart requests to any attacker-controlled servers as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
