All vulnerabilities
CVE-2026-109841GHSA-f72v-6w45-q472

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

undici undicinpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.30.1Also 8.12.2GitHub
Published15 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Impact

undici's fetch() verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server that returns a body different from the pinned digest passes the check.

An application that pins a response with a valid uppercase or mixed-case SRI token receives attacker-controlled bytes with no integrity error. The attacker needs only to control the response body, not the application's integrity metadata. The issue affects response integrity only. The regression was introduced in undici 7.15.0; releases 7.14.0 and earlier lowercase the token and are not affected.

Patches

Upgrade to 7.30.1 or 8.12.2. undici now normalizes the algorithm token to ASCII lowercase before validating it and before selecting the strongest algorithm, so case variants of SHA-256, SHA-384, and SHA-512 are verified correctly.

Workarounds

Use lowercase algorithm tokens (sha256, sha384, sha512) in integrity metadata.

Text from GitHub Advisory Database

Affected versions 8

  • undici, npm>= 7.15.0, < 7.30.1GitHub
  • undici, npm>= 8.0.0, < 8.12.2GitHub
  • undiciaffected: 7.15.0 before 7.30.1CVE List
  • undiciunaffected: 7.30.1CVE List
  • undiciaffected: 8.0.0 before 8.12.2CVE List
  • undiciunaffected: 8.12.2CVE List
  • undici, npmfrom 7.15.0, fixed in 7.30.1OSV
  • undici, npmfrom 8.0.0, fixed in 8.12.2OSV

References 8