CVE-2022-39218: @fastly/js compute Fastly Compute@Edge JS Runtime Has Vulnerability
HIGHCVE-2022-39218 is a HIGH (CVSS 7.5) fastly compute@edge js runtime has vulnerability (CWE-330: Use of Insufficiently Random Values) affecting @fastly/js compute libraries in the npm ecosystem. The issue involves fastly compute@edge js runtime has fixed random number seed during compilation. Remediation is available by upgrading affected packages to version 0.5.3.
CVE-2022-39218 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
How to Fix CVE-2022-39218
To remediate this vulnerability, upgrade all affected @fastly/js compute dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @fastly/js-compute@0.5.3Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @fastly/js-computeHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2022-39218, inspect your project dependencies using npm:
npm ls @fastly/js-computeAnalyze the terminal output to locate any version of @fastly/js compute in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.5.3), your application is affected.
Note: The npm ls @fastly/js-compute command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-330: Use of Insufficiently Random Values, where the product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. In @fastly/js compute, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2022-39218 Affected @fastly/js compute Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@fastly/js-compute
|
npm |
≥ 0.4.0
< 0.5.3
|
0.5.3
|
References
Frequently Asked Questions
What is CVE-2022-39218?
Which @fastly/js compute versions are affected?
What version fixes CVE-2022-39218?
Is @fastly/js-compute affected?
What is the CVSS score of CVE-2022-39218?
What CWE is associated with CVE-2022-39218?
How can I check npm dependencies for CVE-2022-39218?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-cmr8-5w4c-44v8",
"modified" : "2022-09-21T19:22:40Z",
"published" : "2022-09-20T20:45:10Z",
"aliases" : [ "CVE-2022-39218" ],
"summary" : "Fastly Compute@Edge JS Runtime has fixed random number seed during compilation",
"details" : "### Impact\n\n`Math.random` and `crypto.getRandomValues` methods failed to use sufficiently random values. The initial value to seed the CSPRNG (cryptographically secure pseudorandom number generator) was baked-in to the final WebAssembly module meaning the sequence of numbers generated was predictable for that specific WebAssembly module. An attacker with access to that same WebAssembly module that calls the affected methods could use the fixed seed to predict random numbers generated by these functions. This information could be used to bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators.\n\n### Patches\n\nThe problem has been fixed in version 0.5.3.\n\nCorrected `Math.random` and `crypto.getRandomValues` methods to always use sufficiently random values. The previous versions would use a CSPRNG (cryptographically secure pseudorandom number generator) which we would seed with a random value. However, due to our use of Wizer, the initial value to seed the CSPRNG was baked-in to the final WebAssembly module meaning the sequence of numbers generated was predictable for that specific WebAssembly module. The new implementations of both Math.random and `crypto.getRandomValues` do not use a CSPRNG and instead pull random values from WASI (WebAssembly System Interface) libc’s random_get function, which is always a sufficiently random value.\n\n### Workarounds\n\nThere are no workarounds, you must upgrade to version 0.5.3 or later.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@fastly/js-compute"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0.4.0"
}, {
"fixed" : "0.5.3"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/fastly/js-compute-runtime/security/advisories/GHSA-cmr8-5w4c-44v8"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-39218"
}, {
"type" : "WEB",
"url" : "https://github.com/fastly/js-compute-runtime/commit/65524ffc962644e9fc39f4b368a326b6253912a9"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/fastly/js-compute-runtime"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-330", "CWE-335" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2022-09-20T20:45:10Z",
"nvd_published_at" : "2022-09-20T20:15:00Z"
}
}