U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. Vulnerabilities

CVE-2025-22150 Detail

Description

Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f GitHub, Inc.
https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113 GitHub, Inc.
https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0 GitHub, Inc.
https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a GitHub, Inc.
https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385 GitHub, Inc.
https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975 GitHub, Inc.
https://hackerone.com/reports/2913312 GitHub, Inc.

Weakness Enumeration

CWE-ID CWE Name Source
CWE-330 Use of Insufficiently Random Values GitHub, Inc.  

Change History

1 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2025-22150
NVD Published Date:
01/21/2025
NVD Last Modified:
04/14/2026
Source:
GitHub, Inc.