Skip to main content

Red Hat CVE-2025-22150

MEDIUM
Use of Insufficiently Random Values (CWE-330)
2025-01-21 security-advisories@github.com
Information Disclosure Red Hat Suse
6.8
CVSS 3.1 · GitHub Advisory
View

Vulnerability Assessment

Weakness
CWE
CWE-330
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Cryptographic random values
Impact

CVSS score of 6.8 (MEDIUM). Attack characteristics: network attack vector, high complexity, no privileges required, user interaction required. EPSS exploitation probability: 0.60%.
Exploit ScenarioDerived

This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the medium-severity affected system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

Undici is an HTTP/1.1 client. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affected Packages

npm undici fix: 5.28.5, 6.21.1, 7.2.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability is classified under CWE-330. Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses Math.random() to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers. Version information: version 4.5.0.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 6.8 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
SUSE MEDIUM
Red Hat 6.8 MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jan 21, 2025 - 18:15 nvd
MEDIUM 6.8

DescriptionGitHub Advisory

Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses Math.random() to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.

Executive ViewAI

Why It Matters

Organizations using version 4.5.0 and should be aware of notable risk from CVE-2025-22150 rated CVSS 6.8. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Moderate
Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score
0.6%
Top 30% exploitable

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No

Priority Score

35
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +34
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-330 – Use of Insufficiently Random Values

View all
CVE-2017-6026 CRITICAL POC
9.1
CVE-2022-36536 CRITICAL POC
9.8
CVE-2026-27637 CRITICAL POC
9.8
CVE-2022-44938 CRITICAL POC
9.8
CVE-2022-22922 CRITICAL POC
9.8
CVE-2021-41694 CRITICAL POC
9.8
CVE-2021-28024 CRITICAL POC
9.8
CVE-2021-27200 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:1351 ADVISORY https://access.redhat.com/errata/RHSA-2025:1443 ADVISORY https://access.redhat.com/errata/RHSA-2025:1446 ADVISORY https://access.redhat.com/errata/RHSA-2025:1454 ADVISORY https://access.redhat.com/errata/RHSA-2025:1582 ADVISORY https://access.redhat.com/errata/RHSA-2025:1611 ADVISORY https://access.redhat.com/errata/RHSA-2025:1613 ADVISORY https://access.redhat.com/errata/RHSA-2025:17145 ADVISORY https://access.redhat.com/errata/RHSA-2025:1931 ADVISORY https://access.redhat.com/errata/RHSA-2025:21368 ADVISORY https://access.redhat.com/errata/RHSA-2025:2588 ADVISORY https://access.redhat.com/errata/RHSA-2025:3368 ADVISORY https://access.redhat.com/errata/RHSA-2025:3374 ADVISORY https://access.redhat.com/errata/RHSA-2025:3397 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2025-22150 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0232/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0233/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0234/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0237/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0284/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:14706/ REF https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f REF https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113 REF https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0 REF https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a REF https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385 REF https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975 REF https://hackerone.com/reports/2913312

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy