Use of insufficiently random values in undici - CVE-2025-22150

Vulnerability identifier: #VU103227

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-22150

CWE-ID: CWE-330

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to the application uses "Math.random()" from the fetch() function to choose the boundary for a "multipart/form-data" request. A remote attacker with ability to intercept traffic can tamper with the requests going to the backend APIs.

undici
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Server
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Web and Scripting Module
openSUSE Leap
Fedora
IBM Cloud Pak for Security
IBM Watson Knowledge Catalog in Cloud Pak for Data
APEX Cloud Platform for Red Hat OpenShift
IBM Decision Optimization for Cloud Pak for Data
Security QRadar EDR
Storage Fusion Data Foundation
Data Product Hub
Knowledge Catalog Premium Cartridge
IBM Business Automation Manager Open Editions
APEX Cloud Platform for Microsoft Azure
Cognos Dashboards on Cloud Pak for Data
QRadar Suite
nodejs-nodemon
npm
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-docs
nodejs18-docs
nodejs18-devel
npm18
nodejs18
nodejs18-debuginfo
nodejs18-debugsource
corepack18
nodejs20
nodejs20-debugsource
npm20
nodejs20-devel
nodejs20-debuginfo
corepack20
nodejs20-docs
nodejs22-docs
nodejs22-debugsource
nodejs22
nodejs22-devel
npm22
nodejs22-debuginfo
corepack22
nodejs-packaging-bundler
nodejs-packaging
IBM QRadar Data Synchronization App
IBM App Connect Enterprise

Install updates from vendor's website.

undici - addressed in versions 5.28.5, 6.21.1, 7.2.3
IBM Cloud Pak for Security - update to 1.11.9.0
Security QRadar EDR - update to 3.12.16
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
Data Product Hub - update to 5.2.1
Knowledge Catalog Premium Cartridge - update to 5.2
IBM Business Automation Manager Open Editions - update to 9.2.1
APEX Cloud Platform for Microsoft Azure - update to 01.04.01.00
QRadar Suite - update to 1.11.9.0
nodejs-nodemon - update to 3.0.1-1
IBM QRadar Data Synchronization App - update to 3.2.2
APEX Cloud Platform for Red Hat OpenShift - update to 03.02.04.00
IBM Decision Optimization for Cloud Pak for Data - addressed in versions 4.8.9, 5.1.2
Cognos Dashboards on Cloud Pak for Data - update to 5.1.1
npm - addressed in versions 10.8.2-1.18.20.6.1, 10.8.2-1.20.18.2.1
IBM App Connect Enterprise - addressed in versions 12.0.12.11, 13.0.2.2
nodejs - addressed in versions 18.20.6-1, 20.18.2-1
nodejs-devel - addressed in versions 18.20.6-1, 20.18.2-1
nodejs-full-i18n - addressed in versions 18.20.6-1, 20.18.2-1
nodejs-docs - addressed in versions 18.20.6-1, 20.18.2-1
nodejs18-docs - addressed in versions 18.20.6-8.33.1, 18.20.6-150400.9.33.1
nodejs18-devel - addressed in versions 18.20.6-8.33.1, 18.20.6-150400.9.33.1
npm18 - addressed in versions 18.20.6-8.33.1, 18.20.6-150400.9.33.1
nodejs18 - addressed in versions 18.20.6-8.33.1, 18.20.6-150400.9.33.1
nodejs18-debuginfo - addressed in versions 18.20.6-8.33.1, 18.20.6-150400.9.33.1
nodejs18-debugsource - addressed in versions 18.20.6-8.33.1, 18.20.6-150400.9.33.1
corepack18 - update to 18.20.6-150400.9.33.1
nodejs20 - addressed in versions 20.18.2-2.fc40, 20.18.2-2.fc41
nodejs20-debugsource - addressed in versions 20.18.2-150500.11.18.1, 20.18.2-150600.3.9.1
npm20 - addressed in versions 20.18.2-150500.11.18.1, 20.18.2-150600.3.9.1
nodejs20-devel - addressed in versions 20.18.2-150500.11.18.1, 20.18.2-150600.3.9.1
nodejs20-debuginfo - addressed in versions 20.18.2-150500.11.18.1, 20.18.2-150600.3.9.1
nodejs20 - addressed in versions 20.18.2-150500.11.18.1, 20.18.2-150600.3.9.1
corepack20 - addressed in versions 20.18.2-150500.11.18.1, 20.18.2-150600.3.9.1
nodejs20-docs - addressed in versions 20.18.2-150500.11.18.1, 20.18.2-150600.3.9.1
nodejs22-docs - update to 22.13.1-150600.13.6.1
nodejs22-debugsource - update to 22.13.1-150600.13.6.1
nodejs22 - update to 22.13.1-150600.13.6.1
nodejs22-devel - update to 22.13.1-150600.13.6.1
npm22 - update to 22.13.1-150600.13.6.1
nodejs22-debuginfo - update to 22.13.1-150600.13.6.1
corepack22 - update to 22.13.1-150600.13.6.1
nodejs-packaging-bundler - update to 2021.06-4
nodejs-packaging - update to 2021.06-4

• https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f
• https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113
• https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0
• https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a
• https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385
• https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975
• https://hackerone.com/reports/2913312

• MitM attack in Undici
• Fedora 41 update for nodejs20
• Fedora 40 update for nodejs20
• SUSE update for nodejs20
• SUSE update for nodejs18
• SUSE update for nodejs18
• SUSE update for nodejs20
• SUSE update for nodejs22
• Red Hat Enterprise Linux 8 update for the nodejs:20 module
• Red Hat Enterprise Linux 9 update for the nodejs:20 module
• Red Hat Enterprise Linux 9 update for the nodejs:18 module
• Red Hat Enterprise Linux 8 update for the nodejs:18 module
• Red Hat Enterprise Linux 8 update for the nodejs:22 module
• Red Hat Enterprise Linux 9 update for the nodejs:22 module
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in IBM Security QRadar EDR
• Anolis OS update for nodejs:20 module
• Anolis OS update for nodejs:18 module
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• Dell APEX Cloud Platform for Microsoft Azure update for third-party components
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• IBM Storage Fusion Data Foundation update for Undici
• Multiple vulnerabilities in IBM Watson Knowledge Catalog
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM QRadar Data Synchronization App
• Multiple vulnerabilities in IBM Data Product Hub
• Multiple vulnerabilities in IBM QRadar Suite
• Multiple vulnerabilities in IBM Knowledge Catalog Premium Cartridge