CVE-2022-39218

The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the `Math.random` and `crypto.getRandomValues` methods fail to use sufficiently random values. The initial value to seed the PRNG (pseudorandom number generator) is baked-in to the final WebAssembly module, making the sequence of random values for that specific WebAssembly module predictable. An attacker can use the fixed seed to predict random numbers generated by these functions and bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators. The problem has been patched in version 0.5.3. No known workarounds exist.

• CWE-335

• https://github.com/fastly/js-compute-runtime/security/advisories/GHSA-cmr8-5w4c-44v8Third Party Advisory
• https://github.com/fastly/js-compute-runtime/security/advisories/GHSA-cmr8-5w4c-44v8Third Party Advisory

Published

Sep 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39212Nextcloud Talk is an open source chat, video & audio calls c…5.3
• CVE-2022-39213go-cvss is a Go module to manipulate Common Vulnerability Sc…7.5
• CVE-2022-39214Combodo iTop is an open source, web-based IT service managem…7.5
• CVE-2022-39215Tauri is a framework for building binaries for all major des…5.8
• CVE-2022-39216Combodo iTop is an open source, web-based IT service managem…9.8
• CVE-2022-39217some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) i…9.8
• CVE-2022-39219Bifrost is a middleware package which can synchronize MySQL/…6.5
• CVE-2022-3922The Broken Link Checker WordPress plugin before 1.11.20 does…4.8
• CVE-2022-39220SFTPGo is an SFTP server written in Go. Versions prior to 2.…6.1
• CVE-2022-39221McWebserver mod runs a simple HTTP server alongside the Mine…7.5
• CVE-2022-39222Dex is an identity service that uses OpenID Connect to drive…6.5
• CVE-2022-39224Arr-pm is an RPM reader/writer library written in Ruby. Vers…7.8