Если почитать описание на https://nvd.nist.gov/vuln/detail/CVE-2021-41117 то сразу видно, что скриптовые языки не тянут
However, in a nodeJS execution environment, the `window` object is not defined, so it goes down a much less secure solution, also of which has a bug in it. It does look like the library tries to use node's CSPRNG when possible unfortunately, it looks like the `crypto` object is null because a variable was declared with the same name, and set to `null`. So the node CSPRNG path is never taken.
Это раз
А два, The double `String.fromCharCode` is almost certainly unintentional and the source of weak seeding
Проблема то не в том что функцию два раза вызвали, а в том, что string засунули на вход параметру byte и скриптовый езык радостно это скушал.
/**
* Puts a byte in this buffer.
*
* @param b the byte to put.
*/
util.ByteBuffer.prototype.putByte = function(b) {
  this.data += String.fromCharCode(b);
};