Packages / undici / Security

ModerateVulnerabilityGHSA-f72v-6w45-q472CVE-2026-109841Published 23 Oct 2026

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

Affected releases · undici

  • 8.x8.0.0 – 8.12.1Fixed in 8.12.2
  • 7.x7.15.0 – 7.30.0Fixed in 7.30.1

On 8.x, the newest line:

npm install undici@8.12.2
8.x

  1. Affected

    8.0.0 – 8.12.1

    22 releases

  2. Fixed

    8.12.2 – 8.12.3

    2 releases, latest

7.x

  1. Not affected

    7.0.0 – 7.14.0

    19 releases

  2. Affected

    7.15.0 – 7.30.0

    31 releases

  3. Fixed

    7.30.1

    1 release

284 stable releases of undici, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for undici. It is read in your browser and sent nowhere.

What happens

Impact

undici's fetch() verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server that returns a body different from the pinned digest passes the check.

An application that pins a response with a valid uppercase or mixed-case SRI token receives attacker-controlled bytes with no integrity error. The attacker needs only to control the response body, not the application's integrity metadata. The issue affects response integrity only. The regression was introduced in undici 7.15.0; releases 7.14.0 and earlier lowercase the token and are not affected.

Patches

Upgrade to 7.30.1 or 8.12.2. undici now normalizes the algorithm token to ASCII lowercase before validating it and before selecting the strongest algorithm, so case variants of SHA-256, SHA-384, and SHA-512 are verified correctly.

Workarounds

Use lowercase algorithm tokens (sha256, sha384, sha512) in integrity metadata.