Vulnerability	Vulnerable Version
H Insecure Randomness undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Insecure Randomness due to the use of `Math.random()`, an insufficiently random value generator, for boundary selection in multipart/form-data requests. An attacker can predict the boundary values and manipulate multipart requests by intercepting and analyzing multiple requests to deduce the random generator pattern. Note: This is only exploitable if multipart requests are sent to an attacker-controlled server. How to fix Insecure Randomness? Upgrade `undici` to version 5.28.5, 6.21.1, 7.2.3 or higher.	<5.28.5>=6.0.0 <6.21.1>=7.0.0 <7.2.3

Insecure Randomness

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Insecure Randomness due to the use of Math.random(), an insufficiently random value generator, for boundary selection in multipart/form-data requests. An attacker can predict the boundary values and manipulate multipart requests by intercepting and analyzing multiple requests to deduce the random generator pattern.

Note:

This is only exploitable if multipart requests are sent to an attacker-controlled server.

How to fix Insecure Randomness?

Upgrade undici to version 5.28.5, 6.21.1, 7.2.3 or higher.

<5.28.5>=6.0.0 <6.21.1>=7.0.0 <7.2.3

Go back to all versions of this package