Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade nodejs-packaging | Feb 20, 2025 | Jan 21, 2025 |
| Alpine Linux | — | Upgrade nodejs | Aug 8, 2025 | Jan 21, 2025 |
| Amazon_linux_2023 | — | Upgrade nodejs20-debuginfoUpgrade nodejs20-docsUpgrade nodejs20Upgrade nodejs20-full-i18nUpgrade nodejs20-libs-debuginfoUpgrade v8-11.3-develUpgrade nodejs20-libsUpgrade nodejs20-develUpgrade nodejs20-debugsourceUpgrade nodejs20-npm | Jul 4, 2025 | Jan 21, 2025 |
| Debian | — | Upgrade node-undici | May 15, 2025 | Jan 21, 2025 |
| Oracle_linux | — | Upgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade v8-12.4-develUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejsUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18n | Feb 14, 2025 | Jan 21, 2025 |
| Red Hat Jboss Eap | — | — | Jan 23, 2025 | Jan 21, 2025 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejsUpgrade v8-12.4-develUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18n | Feb 13, 2025 | Jan 21, 2025 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejsUpgrade v8-12.4-develUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsource | Feb 14, 2025 | Jan 21, 2025 |
| Suse | — | Upgrade nodejs20-develUpgrade nodejs20-docsUpgrade npm20Upgrade nodejs18-develUpgrade npm22Upgrade corepack22Upgrade nodejs22-develUpgrade nodejs20Upgrade corepack20Upgrade nodejs18Upgrade nodejs22-docsUpgrade npm18Upgrade nodejs18-docsUpgrade nodejs22 | Jan 27, 2025 | Jan 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub