MediumGHSA-c76h-2ccp-4975CVE-2025-22150

Use of Insufficiently Random Values in undici

Published 21 Jan 2025 · Updated 10 Sept 2026

Affected packages

undicinpm
Affected
>=4.5.0 <5.28.5
Fixed in
5.28.5
Update to the fixed version for your release line, for example:npm install undici@5.28.5
undicinpm
Affected
>=6.0.0 <6.21.1
Fixed in
6.21.1
Update to the fixed version for your release line, for example:npm install undici@6.21.1
undicinpm
Affected
>=7.0.0 <7.2.3
Fixed in
7.2.3
Update to the fixed version for your release line, for example:npm install undici@7.2.3

Details

Impact

Undici `fetch()` uses Math.random() to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known.

If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, An attacker can tamper with the requests going to the backend APIs if certain conditions are met.

Patches

This is fixed in 5.28.5; 6.21.1; 7.2.3.

Workarounds

Do not issue multipart requests to attacker controlled servers.

References

  • https://hackerone.com/reports/2913312
  • https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f

Is GHSA-c76h-2ccp-4975 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected undici, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.