Packages / undici / Security

LowVulnerabilityGHSA-9qxr-qj54-h672Published 4 Apr 2024

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Affected · undici

  • < 5.28.4
  • >= 6.0.0, < 6.11.1

Fixed in

6.11.1

npm install undici@6.11.1

  1. Affected

    0.1.0 – 5.28.3

    149 releases

  2. Fixed

    5.28.4 – 5.29.0

    3 releases

  3. Affected

    6.0.0 – 6.11.0

    19 releases

  4. Fixed

    6.11.1 – 8.12.3

    113 releases, latest

284 stable releases of undici, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.