CVE-2026-109841

Name of the Vulnerable Software and Affected Versions undici versions 7.15.0 through 7.30.0 undici versions 8.0.0 through 8.12.1

Description The fetch() implementation in this Node.js HTTP client library incorrectly verifies Subresource Integrity (SRI) metadata. The library matches the algorithm token against a lowercase-only set, causing valid uppercase or mixed-case tokens (such as SHA256) to be treated as unknown and skipped. If no recognized algorithms remain, the integrity list is treated as empty and the response is accepted regardless of whether the body matches the pinned digest. This allows an attacker who controls the response body to deliver malicious bytes to an application using non-lowercase SRI tokens without triggering an integrity error.

Recommendations Update to version 7.30.1 or later. Update to version 8.12.2 or later. As a temporary workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata.