BIT-node-2022-35255

BIT-node-2022-35255 PUBLISHED CVSS 9.100000381469727 CRITICAL

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.

Risk Scores

CVSS 3.1

9.100000381469727

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions
Bitnami	node	15.0.0, 16.0.0, 16.13.0

Exploit Intelligence

https://hackerone.com/reports/1690000 (osv)

Timeline

Mar 6, 2024 CVE Published
Apr 3, 2025 CVE Updated
Apr 30, 2026 Distribution Patch

References

https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf url
https://hackerone.com/reports/1690000 url
https://security.netapp.com/advisory/ntap-20230113-0002/ url
https://www.debian.org/security/2023/dsa-5326 url
https://nvd.nist.gov/vuln/detail/CVE-2022-35255 url

Open in Interactive Console →