GHSA-f72v-6w45-q472

Source

https://github.com/advisories/GHSA-f72v-6w45-q472

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f72v-6w45-q472/GHSA-f72v-6w45-q472.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f72v-6w45-q472

Aliases

CVE-2026-109841

Published

2026-10-23T22:12:57Z

Modified

2026-10-23T22:30:04Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

Details

Impact

undici's fetch() verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server that returns a body different from the pinned digest passes the check.

An application that pins a response with a valid uppercase or mixed-case SRI token receives attacker-controlled bytes with no integrity error. The attacker needs only to control the response body, not the application's integrity metadata. The issue affects response integrity only. The regression was introduced in undici 7.15.0; releases 7.14.0 and earlier lowercase the token and are not affected.

Patches

Upgrade to 7.30.1 or 8.12.2. undici now normalizes the algorithm token to ASCII lowercase before validating it and before selecting the strongest algorithm, so case variants of SHA-256, SHA-384, and SHA-512 are verified correctly.

Workarounds

Use lowercase algorithm tokens (sha256, sha384, sha512) in integrity metadata.

Database specific

{
    "cwe_ids":  [
        "CWE-178"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-23T22:12:57Z",
    "nvd_published_at":  "2026-10-15T19:17:21Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / undici

Package

Name: undici; View open source insights on deps.dev
Purl: pkg:npm/undici

Affected ranges

Type: SEMVER
Events: Introduced

7.15.0

Fixed

7.30.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f72v-6w45-q472/GHSA-f72v-6w45-q472.json"

npm / undici

Package

Name: undici; View open source insights on deps.dev
Purl: pkg:npm/undici

Affected ranges

Type: SEMVER
Events: Introduced

8.0.0

Fixed

8.12.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-f72v-6w45-q472/GHSA-f72v-6w45-q472.json"