Executive brief
Undici is a popular HTTP client library for Node.js used to fetch web resources. The library uses a weak random number generator (Math.random()) to create boundaries for multipart form-data requests, which can be predicted by attackers if they receive enough sample values. An attacker controlling a server that receives multipart requests could potentially tamper with data being sent to backend APIs.
Technical details
The vulnerability is a use of insufficiently random values (CWE-330) in undici's fetch() implementation. When constructing multipart/form-data requests, the library uses JavaScript's Math.random() to generate the boundary delimiter, which is predictable if an attacker can observe multiple output values. The attack requires a mechanism where an application sends multipart requests to an attacker-controlled website, allowing the attacker to collect enough random values to predict future boundaries. An attacker exploiting this can forge or tamper with multipart request boundaries sent to legitimate backend APIs. The vulnerability affects versions 4.5.0–5.28.4, 6.0.0–6.21.0, and 7.0.0–7.2.2; patches are available in 5.28.5, 6.21.1, and 7.2.3.
Affected products
- Node.js undici 4.5.0–5.28.4, 6.0.0–6.21.0, 7.0.0–7.2.2
Timeline
- 2025-01-21: disclosed
- 2025-01-21: patched: Versions 5.28.5, 6.21.1, and 7.2.3 released