CVE-2022-39218

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-39218
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39218.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-39218
Aliases
Published
2022-09-20T19:50:08Z
Modified
2026-04-12T01:28:01.636556Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Random number seed fixed during compilation
Details

The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the Math.random and crypto.getRandomValues methods fail to use sufficiently random values. The initial value to seed the PRNG (pseudorandom number generator) is baked-in to the final WebAssembly module, making the sequence of random values for that specific WebAssembly module predictable. An attacker can use the fixed seed to predict random numbers generated by these functions and bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators. The problem has been patched in version 0.5.3. No known workarounds exist.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-335"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39218.json"
}
References

Affected packages

Git / github.com/fastly/js-compute-runtime

Affected ranges

Type
GIT
Repo
https://github.com/fastly/js-compute-runtime
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b1462ec24c007d3d539f1f127820bcba520749b9

Affected versions

v0.*
v0.1.0
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.3.0
v0.4.0
v0.5.0
v0.5.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39218.json"
vanir_signatures_modified 
"2026-04-12T01:28:01Z"
vanir_signatures 
[
    {
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/fastly/js-compute-runtime/commit/b1462ec24c007d3d539f1f127820bcba520749b9",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "249958961552085738761155960402475767889",
                "35428887552458038646777811912579597934",
                "169453485287413971393267609851161990099",
                "269949369241885828668710408127051052163",
                "195661418498791944041492865942309910824",
                "239114475721186748961839023685268655779",
                "320168658372653175933002033924305186426",
                "176499200392278882423113850393438238845",
                "312835695948482974491218686478787945744",
                "290791290231081818979749674290638831916",
                "132836268658624714301114881466680694585",
                "279058089316256979710344837222320104413",
                "334167577717399971118404517464435090700",
                "80166886064224958571791451477584915",
                "289223079413283631494840601951597572250",
                "16114418957108579657211044135341645789",
                "994028179395471996674837567259536518",
                "269747033938928188883030582142975255512",
                "276656526357750070510168852728537386175",
                "239589556748886629027685282167829565757",
                "126489357981221494990820182266805695579",
                "79846233385130477187733556246378947802",
                "258308190387842847302671361796260147147",
                "237245919257171382994069803421171377676",
                "14314235302110270503416201409022847092",
                "291907738882863308524846391552323985666",
                "221522065199306894949980712753077357993",
                "79583398148994028374494523967513151919",
                "65546423964252632147699994254998627590",
                "642418738419310196270728429669509609",
                "126090411574331355968058591820983360670",
                "28247987597334665151339075586476563527",
                "309422694235016588731842574836373375260",
                "256987983907127683119406856501016837",
                "155378955146467375053318836652230992141",
                "325456751384980660230675389423450584187",
                "272506485290858203297392815868891538268",
                "186878297060797630621813612898343317024"
            ]
        },
        "id": "CVE-2022-39218-cca96806",
        "deprecated": false,
        "target": {
            "file": "c-dependencies/js-compute-runtime/builtins/backend.cpp"
        }
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/fastly/js-compute-runtime/commit/b1462ec24c007d3d539f1f127820bcba520749b9",
        "digest": {
            "function_hash": "194633171020269005479178297921786633346",
            "length": 5156.0
        },
        "id": "CVE-2022-39218-ff64e966",
        "deprecated": false,
        "target": {
            "file": "c-dependencies/js-compute-runtime/builtins/backend.cpp",
            "function": "Backend::register_dynamic_backend"
        }
    }
]