The vulnerability CVE-2025-22150 affects the undici HTTP client library used in Node.js. It uses Math.random() to generate multipart/form-data boundaries, which is insufficiently random and predictable if some values are leaked. An attacker who can induce an application to send multipart requests to an attacker-controlled site may obtain these values and subsequently tamper with requests sent to backend APIs. The issue is classified under CWE-330 (Use of Insufficiently Random Values) and CWE-863 (Incorrect Authorization). Red Hat has identified this vulnerability in their Node.js packages distributed with Red Hat Enterprise Linux 8 and 9 and has issued a security advisory with a CVSS v3 score of 6.8 (high severity).

The vulnerability allows an attacker to potentially bypass protection mechanisms by predicting random values used in multipart/form-data boundaries. This can lead to tampering with requests to backend APIs, potentially compromising confidentiality and integrity of data. The vulnerability does not affect availability. No known exploits in the wild have been reported by Red Hat at this time.

Red Hat has released security updates for Node.js packages that address this vulnerability. Users should apply the official Red Hat security updates as soon as possible. Before applying the update, ensure all previously released errata relevant to the system have been applied. No alternative mitigations are specified by Red Hat. Patch status is confirmed as fixed in updated Node.js packages distributed by Red Hat.