CVE-2025-22150: Use of Insufficiently Random Values in undici
6.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.10323%
CWE
Published
1/21/2025
Updated
1/22/2025
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| undici | npm | >= 4.5.0, < 5.28.5 | 5.28.5 |
| undici | npm | >= 6.0.0, < 6.21.1 | 6.21.1 |
| undici | npm | >= 7.0.0, < 7.2.3 | 7.2.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from insecure random number generation for multipart boundaries. The commit diff shows the boundary generation in extractBody() originally used Math.random() (CWE-330). The line const boundary = ...Math.random()... in body.js was identified as vulnerable in multiple references (HackerOne report, NVD description). The patch replaces Math.random() with crypto.randomInt, confirming this was the vulnerable code path. The function's role in generating security-sensitive boundaries and direct use of non-cryptographic RNG makes it the clear vulnerability source.