Fastly Compute@Edge JS Runtime has fixed random number seed during compilation

Description

Math.random and crypto.getRandomValues methods failed to use sufficiently random values. The initial value to seed the CSPRNG (cryptographically secure pseudorandom number generator) was baked-in to the final WebAssembly module meaning the sequence of numbers generated was predictable for that specific WebAssembly module.

Recommendation

Update the @fastly/js-compute package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.4.0, < 0.5.3
• Patched version(s): 0.5.3

References

• GHSA-cmr8-5w4c-44v8
• CVE-2022-39218
• CWE-330
• CWE-335
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A6

Related Issues

• @fastly/js-compute has a use-after-free in some host call implementations - CVE-2024-38375
• Insecure random number generation in keypair - CVE-2021-41117
• JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-node-esm-runtime - CVE-2022-36083
• JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-node-cjs-runtime - CVE-2022-36083

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@fastly/js-compute