{"id":"CVE-2022-39218","aliases":["EUVD-2022-6780","GHSA-cmr8-5w4c-44v8"],"status":"published","title":"Random number seed fixed during compilation","description":"The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the `Math.random` and `crypto.getRandomValues` methods fail to use sufficiently random values. The initial value to seed the PRNG (pseudorandom number generator) is baked-in to the final WebAssembly module, making the sequence of random values for that specific WebAssembly module predictable. An attacker can use the fixed seed to predict random numbers generated by these functions and bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators. The problem has been patched in version 0.5.3. No known workarounds exist.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00922,"percentile":0.60656,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-330","CWE-335"],"published":"2022-09-20T19:50:08Z","modified":"2026-10-28T10:28:28Z","fixes":[{"ecosystem":"npm","package":"@fastly/js-compute","fixed_in":["0.5.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@fastly/js-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0"},{"fixed":"0.5.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@fastly/js-compute","ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.0"},{"fixed":"0.5.3"}]}]}],"products":[{"vendor":"fastly","product":"js-compute"},{"vendor":"fastly","product":"js-compute-runtime"}],"references":[{"url":"https://github.com/fastly/js-compute-runtime/security/advisories/GHSA-cmr8-5w4c-44v8","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/fastly/js-compute-runtime/commit/65524ffc962644e9fc39f4b368a326b6253912a9","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39218","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cmr8-5w4c-44v8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39218.json","tags":["advisory"]},{"url":"https://github.com/fastly/js-compute-runtime","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-39218","title":"Random number seed fixed during compilation","description":"The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the `Math.random` and `crypto.getRandomValues` methods fail to use sufficiently random values. The initial value to seed the PRNG (pseudorandom number generator) is baked-in to the final WebAssembly module, making the sequence of random values for that specific WebAssembly module predictable. An attacker can use the fixed seed to predict random numbers generated by these functions and bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators. The problem has been patched in version 0.5.3. No known workarounds exist.","status":"published","published":"2022-09-20T19:50:08Z","modified":"2025-04-23T16:56:59.041Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-335"],"updated_at":"2026-11-02T14:34:39.559326Z"}],"euvd":[{"id":"EUVD-2022-6780","description":"The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the `Math.random` and `crypto.getRandomValues` methods fail to use sufficiently random values. The initial value to seed the PRNG (pseudorandom number generator) is baked-in to the final WebAssembly module, making the sequence of random values for that specific WebAssembly module predictable. An attacker can use the fixed seed to predict random numbers generated by these functions and bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators. The problem has been patched in version 0.5.3. No known workarounds exist.","status":"published","published":"2022-09-20T19:50:08Z","modified":"2025-04-23T16:56:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:11.440801Z"}],"ghsa":[{"id":"GHSA-cmr8-5w4c-44v8","title":"Fastly Compute@Edge JS Runtime has fixed random number seed during compilation","description":"### Impact\n\n`Math.random` and `crypto.getRandomValues` methods failed to use sufficiently random values. The initial value to seed the CSPRNG (cryptographically secure pseudorandom number generator) was baked-in to the final WebAssembly module meaning the sequence of numbers generated was predictable for that specific WebAssembly module. An attacker with access to that same WebAssembly module that calls the affected methods could use the fixed seed to predict random numbers generated by these functions. This information could be used to bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators.\n\n### Patches\n\nThe problem has been fixed in version 0.5.3.\n\nCorrected `Math.random` and `crypto.getRandomValues` methods to always use sufficiently random values. The previous versions would use a CSPRNG (cryptographically secure pseudorandom number generator) which we would seed with a random value. However, due to our use of Wizer, the initial value to seed the CSPRNG was baked-in to the final WebAssembly module meaning the sequence of numbers generated was predictable for that specific WebAssembly module. The new implementations of both Math.random and `crypto.getRandomValues` do not use a CSPRNG and instead pull random values from WASI (WebAssembly System Interface) libc’s random_get function, which is always a sufficiently random value.\n\n### Workarounds\n\nThere are no workarounds, you must upgrade to version 0.5.3 or later.","status":"published","published":"2022-09-20T20:45:10Z","modified":"2023-01-30T05:03:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-330","CWE-335"],"updated_at":"2026-11-02T14:36:28.424013Z"}],"nvd":[{"id":"CVE-2022-39218","description":"The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the `Math.random` and `crypto.getRandomValues` methods fail to use sufficiently random values. The initial value to seed the PRNG (pseudorandom number generator) is baked-in to the final WebAssembly module, making the sequence of random values for that specific WebAssembly module predictable. An attacker can use the fixed seed to predict random numbers generated by these functions and bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators. The problem has been patched in version 0.5.3. No known workarounds exist.","status":"published","published":"2022-09-20T20:15:10.447Z","modified":"2026-06-17T04:57:56.313Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-335"],"updated_at":"2026-11-02T14:07:28.118799Z"}],"osv":[{"id":"CVE-2022-39218","title":"Random number seed fixed during compilation","description":"The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the `Math.random` and `crypto.getRandomValues` methods fail to use sufficiently random values. The initial value to seed the PRNG (pseudorandom number generator) is baked-in to the final WebAssembly module, making the sequence of random values for that specific WebAssembly module predictable. An attacker can use the fixed seed to predict random numbers generated by these functions and bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators. The problem has been patched in version 0.5.3. No known workarounds exist.","status":"published","published":"2022-09-20T19:50:08Z","modified":"2026-10-28T10:28:28.379407989Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-335"],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"GHSA-cmr8-5w4c-44v8","title":"Fastly Compute@Edge JS Runtime has fixed random number seed during compilation","description":"### Impact\n\n`Math.random` and `crypto.getRandomValues` methods failed to use sufficiently random values. The initial value to seed the CSPRNG (cryptographically secure pseudorandom number generator) was baked-in to the final WebAssembly module meaning the sequence of numbers generated was predictable for that specific WebAssembly module. An attacker with access to that same WebAssembly module that calls the affected methods could use the fixed seed to predict random numbers generated by these functions. This information could be used to bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators.\n\n### Patches\n\nThe problem has been fixed in version 0.5.3.\n\nCorrected `Math.random` and `crypto.getRandomValues` methods to always use sufficiently random values. The previous versions would use a CSPRNG (cryptographically secure pseudorandom number generator) which we would seed with a random value. However, due to our use of Wizer, the initial value to seed the CSPRNG was baked-in to the final WebAssembly module meaning the sequence of numbers generated was predictable for that specific WebAssembly module. The new implementations of both Math.random and `crypto.getRandomValues` do not use a CSPRNG and instead pull random values from WASI (WebAssembly System Interface) libc’s random_get function, which is always a sufficiently random value.\n\n### Workarounds\n\nThere are no workarounds, you must upgrade to version 0.5.3 or later.","status":"published","published":"2022-09-20T20:45:10Z","modified":"2023-11-08T04:10:15.247693Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-330","CWE-335"],"updated_at":"2026-11-02T15:46:45.28161Z"}]}}