Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade npmUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade v8-12.4-devel | Feb 20, 2025 | Jan 21, 2025 |
| Alpine Linux | — | Upgrade nodejs | Aug 8, 2025 | Jan 21, 2025 |
| Amazon_linux_2023 | — | Upgrade nodejs20Upgrade nodejs20-debuginfoUpgrade nodejs20-full-i18nUpgrade nodejs20-docsUpgrade nodejs20-debugsourceUpgrade nodejs20-libsUpgrade nodejs20-npmUpgrade v8-11.3-develUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-devel | Jul 4, 2025 | Jan 21, 2025 |
| Debian | — | Upgrade node-undici | May 15, 2025 | Jan 21, 2025 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-packagingUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-packaging-bundler | Feb 14, 2025 | Jan 21, 2025 |
| Red Hat Jboss Eap | — | — | Jan 23, 2025 | Jan 21, 2025 |
| Redhat_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade v8-12.4-develUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade nodejsUpgrade npmUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade nodejs-docs | Feb 13, 2025 | Jan 21, 2025 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade v8-12.4-develUpgrade nodejs-debugsourceUpgrade nodejs-libs | Feb 14, 2025 | Jan 21, 2025 |
| Suse | — | Upgrade npm18Upgrade nodejs22-docsUpgrade nodejs18-docsUpgrade nodejs22Upgrade nodejs18-develUpgrade nodejs22-develUpgrade npm22Upgrade npm20Upgrade nodejs20-docsUpgrade nodejs20-develUpgrade nodejs18Upgrade corepack20Upgrade nodejs20Upgrade corepack22 | Jan 27, 2025 | Jan 21, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub