CVE-2026-120423

Name of the Vulnerable Software and Affected Versions undici versions 7.15.0 through 7.30.1 undici versions 8.0.0 through 8.12.3

Description The fetch function incorrectly verifies Subresource Integrity (SRI) metadata by splitting the integrity string only on single spaces. Because the SRI grammar allows any ASCII whitespace, including horizontal tabs, any digest preceded by such whitespace is treated as an unrecognized token and skipped. If no recognized algorithms remain, the integrity list is treated as empty, allowing a server to return a response body that differs from the pinned digest without triggering an integrity error. This allows an attacker who controls the response body to deliver malicious bytes to an application using whitespace-surrounded SRI values.

Recommendations Update to version 7.30.2 or later. Update to version 8.12.4 or later. Supply SRI integrity metadata without surrounding whitespace, using only a single space to separate multiple digests.