Most recent entries from all

ALSA-2025:1351 — Important: nodejs:20 security update

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: nodejs-packaging-bundler, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* undici: Undici Uses Insufficiently Random Values (CVE-2025-22150) * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083) * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2025-22150

Affected: Alpaquita:23: nodejs, Alpaquita:stream: nodejs, BellSoft Hardened Containers:23: nodejs, BellSoft Hardened Containers:stream: nodejs

certfr-2025-avi-0170 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2025-avi-0170

EUVD-2026-215265

fkie_cve-2025-22150

Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.

GHSA-c76h-2ccp-4975 — Use of Insufficiently Random Values in undici

Affected: npm: undici

### Impact

[Undici `fetch()` uses Math.random()](https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113) to choose the boundary for a multipart/form-data request. It is known that the output of Math.random() can be predicted if several of its generated values are known.

If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, An attacker can tamper with the requests going to the backend APIs if certain conditions are met.

### Patches

This is fixed in 5.28.5; 6.21.1; 7.2.3.

### Workarounds

Do not issue multipart requests to attacker controlled servers.

### References

* https://hackerone.com/reports/2913312 * https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f

msrc_CVE-2025-22150 — Undici Uses Insufficiently Random Values

msrc_CVE-2025-22150

openSUSE-SU-2025:14706-1 — corepack22-22.13.0-1.1 on GA media

corepack22-22.13.0-1.1 on GA media

RHSA-2025:17145 — Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17 security, enhancement & bug fix update

undici: Undici Uses Insufficiently Random Values

SUSE-SU-2025:0232-1 — Security update for nodejs20

Security update for nodejs20

UBUNTU-CVE-2025-22150

Affected: Ubuntu:24.04:LTS: node-undici, Ubuntu:25.10: node-undici, Ubuntu:26.04:LTS: node-undici

WID-SEC-W-2025-0156 — Node.js: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben, einen Denial-of-Service-Zustand herbeizuführen oder nicht näher spezifizierte Angriffe zu starten.