{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-21T01:10:57.774","vulnerabilities":[{"cve":{"id":"CVE-2022-39218","sourceIdentifier":"security-advisories@github.com","published":"2022-09-20T20:15:10.447","lastModified":"2024-11-21T07:17:48.703","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the `Math.random` and `crypto.getRandomValues` methods fail to use sufficiently random values. The initial value to seed the PRNG (pseudorandom number generator) is baked-in to the final WebAssembly module, making the sequence of random values for that specific WebAssembly module predictable. An attacker can use the fixed seed to predict random numbers generated by these functions and bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators. The problem has been patched in version 0.5.3. No known workarounds exist."},{"lang":"es","value":"El JS Compute Runtime para la plataforma Compute@Edge de Fastly proporciona el entorno en el que se ejecuta JavaScript cuando se usa el SDK de JavaScript de Compute@Edge. En versiones anteriores a 0.5.3, los métodos \"Math.random\" y \"crypto.getRandomValues\" no usan valores suficientemente aleatorios. El valor inicial para sembrar el PRNG (generador de números pseudoaleatorios) está incorporado en el módulo final de WebAssembly, haciendo que la secuencia de valores aleatorios para ese módulo específico de WebAssembly sea predecible. Un atacante puede usar la semilla fija para predecir los números aleatorios generados por estas funciones y omitir los controles de seguridad criptográficos, por ejemplo para divulgar datos confidenciales cifrados por las funciones que usan estos generadores. El problema ha sido parcheado en versión 0.5.3. No se presentan mitigaciones conocidas"}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-335"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fastly:js-compute:*:*:*:*:*:node.js:*:*","versionEndExcluding":"0.5.3","matchCriteriaId":"46F2A5C7-1BE4-4F70-B70D-84E0FF3AED17"}]}]}],"references":[{"url":"https://github.com/fastly/js-compute-runtime/security/advisories/GHSA-cmr8-5w4c-44v8","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/fastly/js-compute-runtime/security/advisories/GHSA-cmr8-5w4c-44v8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}