CVE-2025-22150

What it actually does

Undici generated multipart/form-data boundaries using Math.random() in affected versions starting with 4.5.0 and before 5.28.5, 6.21.1, and 7.2.3. Because Math.random() is not a cryptographically secure random number generator, an attacker who can observe enough generated boundary values may be able to predict future multipart boundaries. If an application can be induced to send multipart requests to an attacker-controlled endpoint and later sends multipart requests to sensitive backend APIs, the attacker may be able to craft input that collides with or manipulates multipart parsing, potentially altering request content and compromising confidentiality and integrity. The attack requires specific application behavior and user or application interaction, which raises exploitation complexity.

Why it matters to the business

Successful exploitation could allow manipulation of application-to-backend API requests, potentially causing unauthorized data submission, altered file uploads, or exposure of sensitive data handled in multipart requests. The risk is most relevant for Node.js applications that both use Undici for multipart/form-data and can be made to send multipart requests to attacker-controlled destinations. The issue is not listed in CISA KEV, is not known to be used in ransomware campaigns, and has a low EPSS score, but affected dependency versions may be widely embedded through transitive Node.js dependencies, so software composition review is important.

How an attack unfolds

An attacker first needs a path to make the target application issue multipart/form-data requests to an attacker-controlled server, such as through a webhook, integration, URL submission workflow, or user-driven upload forwarding feature. By observing several multipart boundaries generated by the vulnerable Undici client, the attacker may infer enough Math.random() output to predict future boundary values. The attacker then uses that prediction to prepare multipart content intended to interfere with how a later request is parsed by a backend API. If the application subsequently sends attacker-influenced multipart data to a sensitive backend while using a predictable boundary, the attacker may cause extra fields, altered parts, or malformed parsing outcomes that affect the backend request. This is a conditional attack: without a mechanism to observe generated multipart requests and influence later backend-bound multipart content, exploitation is unlikely.

How to fix it

Upgrade Undici to a fixed version: 5.28.5 or later for the 5.x line, 6.21.1 or later for the 6.x line, or 7.2.3 or later for the 7.x line. For source builds, ensure the fix corresponding to commit 6139ed2e0c787853243de58ef7c4301b26ca66f2 is present. Review both direct and transitive dependencies because Undici may be pulled in by frameworks, SDKs, or Node.js HTTP client wrappers. If immediate upgrade is not possible, prevent the application from issuing multipart requests to attacker-controlled or user-supplied destinations, restrict outbound HTTP destinations with allowlists, and avoid forwarding attacker-controlled multipart content to sensitive backend APIs without normalization and validation.

How to confirm the fix worked

Confirm the deployed dependency tree no longer contains affected Undici versions. Use package manager tooling such as npm ls undici, pnpm why undici, yarn why undici, or software composition analysis output to verify all resolved versions are 5.28.5, 6.21.1, 7.2.3, or newer as appropriate. Inspect lockfiles and container images, not only package.json declarations, because transitive dependencies may pin older versions. Where source builds are used, verify the patch commit 6139ed2e0c787853243de58ef7c4301b26ca66f2 or equivalent change is included. Functionally test application features that send multipart/form-data to ensure uploads and integrations still work after upgrade. To assess exposure, identify code paths that send multipart requests to user-controlled URLs and determine whether any sensitive backend multipart calls can include attacker-influenced content.

Typical attack path

1. Identify a Node.js application or service using an affected Undici version for multipart/form-data requests.
2. Find a feature that causes the application to send multipart requests to an attacker-controlled URL or service.
3. Collect multiple multipart boundary values generated by the vulnerable client.
4. Use predictability in Math.random()-derived values to estimate future multipart boundaries.
5. Craft multipart content that is designed to collide with or manipulate parsing of a later backend-bound request.
6. Trigger the application to send the crafted multipart request to a sensitive backend API.
7. Leverage altered backend request contents to access data, change submitted fields, or affect file/upload handling.

How to detect it

There is no universal exploit signature for this issue, and exploitation is highly application-dependent. To look for prior exploitation, correlate outbound HTTP client logs, proxy logs, egress firewall logs, webhook delivery logs, and application request logs. Focus on periods when affected Undici versions were deployed. Look for multipart/form-data requests from the application to unusual or user-supplied external domains, especially repeated requests that could have allowed boundary observation. Then correlate those events with subsequent multipart requests to backend APIs that contain unexpected extra fields, duplicated part names, malformed multipart separators, parse errors, unusual file metadata, or authorization-sensitive field changes. Useful log sources include Node.js application logs, reverse proxy access logs, outbound proxy logs, API gateway logs, WAF logs, backend upload service logs, and dependency/runtime inventory. Because the weakness concerns predictable boundary generation rather than a fixed payload, treat detections as behavioral: untrusted outbound multipart traffic plus anomalous backend multipart parsing is more meaningful than any single string.

• Content-Type: multipart/form-data; boundary=----formdata-undici-
• ----formdata-undici-
• node_modules/undici/package.json
• "undici"

What your security team should do

• Inventory Node.js services, containers, serverless functions, and build artifacts for Undici versions from 4.5.0 up to but not including 5.28.5, 6.21.1, or 7.2.3.
• Prioritize remediation for applications that send multipart/form-data to user-supplied URLs, external webhooks, third-party integrations, or untrusted domains.
• Upgrade Undici to a fixed version and refresh lockfiles and container images so transitive dependency copies are actually replaced.
• Implement outbound destination allowlisting for server-side HTTP requests, especially for features that support uploads, webhooks, URL fetchers, or integrations.
• Add application-level safeguards that normalize or regenerate multipart bodies before forwarding them to backend APIs.
• Review logs for historical outbound multipart requests to untrusted domains followed by unusual backend multipart API behavior.
• Keep this issue below actively exploited KEV-level emergencies unless local exposure analysis shows attacker-observable multipart generation and sensitive backend forwarding paths.