A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-packaging | Oct 20, 2022 | Oct 18, 2022 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Mar 26, 2024 | Dec 5, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejsUpgrade v8-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfo | Feb 17, 2025 | Sep 23, 2022 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-devel | Oct 20, 2022 | Oct 17, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Dec 5, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Dec 5, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-javascriptUpgrade nodejs-libsUpgrade nodejsUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-11Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-11-develUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-17-ruby-develUpgrade nodejs-nodemonUpgrade graalvm22-ce-17-llvmUpgrade npmUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-11-espressoUpgrade nodejs-develUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade nodejs-packaging-bundlerUpgrade graalvm22-ce-17-javascriptUpgrade nodejs-docsUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-11-fastr | Oct 18, 2022 | Sep 23, 2022 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-packaging | Oct 20, 2022 | Oct 17, 2022 |
| Rocky_linux | — | Upgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade npmUpgrade nodejs-debuginfo | Mar 12, 2024 | Dec 5, 2022 |
| Suse | — | Upgrade corepack18Upgrade nodejs16Upgrade nodejs16-docsUpgrade nodejs18Upgrade nodejs16-develUpgrade nodejs18-develUpgrade npm18Upgrade nodejs18-docsUpgrade npm16Upgrade corepack16 | Oct 26, 2022 | Oct 5, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Dec 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub