Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade v8-12.4-develUpgrade nodejs-nodemon | Feb 20, 2025 | Jan 21, 2025 |
| Alpine Linux | — | Upgrade nodejs | Aug 8, 2025 | Jan 21, 2025 |
| Amazon_linux_2023 | — | Upgrade nodejs20-develUpgrade nodejs20-npmUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-debugsourceUpgrade v8-11.3-develUpgrade nodejs20-libsUpgrade nodejs20-full-i18nUpgrade nodejs20-debuginfoUpgrade nodejs20-docsUpgrade nodejs20 | Jul 4, 2025 | Jan 21, 2025 |
| Debian | — | Upgrade node-undici | May 15, 2025 | Jan 21, 2025 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade nodejs-packaging-bundler | Feb 14, 2025 | Jan 21, 2025 |
| Red Hat Jboss Eap | — | — | Jan 23, 2025 | Jan 21, 2025 |
| Redhat_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade v8-12.4-develUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade nodejs-docs | Feb 13, 2025 | Jan 21, 2025 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade v8-12.4-develUpgrade nodejs-libsUpgrade nodejsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-full-i18n | Feb 14, 2025 | Jan 21, 2025 |
| Suse | — | Upgrade nodejs22Upgrade npm18Upgrade nodejs22-docsUpgrade nodejs18-docsUpgrade nodejs20-develUpgrade nodejs20-docsUpgrade corepack22Upgrade npm22Upgrade nodejs22-develUpgrade nodejs20Upgrade nodejs18Upgrade corepack20Upgrade nodejs18-develUpgrade npm20 | Jan 27, 2025 | Jan 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub