Live › vulnerability › CVE-2026-109841
Go to dashboardundici's fetch() skips Subresource Integrity algorithm tokens that are valid but not lowercase, such as SHA256-, so a pinned digest is not checked. An attacker who controls the response body can serve different bytes to an application that pinned the response with such a token and receive no integrity error.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 22:15 UTC, 1h before NVD. All times on this page are UTC.
Applications that use undici's fetch() with SRI integrity metadata to verify response bodies, on undici 7.15.0 to 7.30.0 or 8.0.0 to 8.12.1. The bug needs the pinned token to be valid but not lowercase, and the attacker must be able to control the response body, for example through a compromised or spoofed server or an intercepted connection. Releases 7.14.0 and earlier are not affected, and code that does not use integrity metadata with fetch() is not exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| undici | npm | >= 7.15.0, < 7.30.1 | 7.30.1 |
| undici | npm | >= 8.0.0, < 8.12.2 | 8.12.2 |
| nodejs undici | vendor | >= 7.15.0, < 7.30.1 | 7.30.1 |
| nodejs undici | vendor | >= 8.0.0, < 8.12.2 | 8.12.2 |
npm ls undici to list installed undici versions.integrity: options or integrity values in fetch calls that start with an uppercase or mixed-case algorithm such as SHA256-.7.15.0 or later and below 7.30.1 or in 8.0.0 to below 8.12.2.7.30.1 on the 7.x line or 8.12.2 on the 8.x line.sha256, sha384, sha512) in integrity metadata.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
undici's fetch() verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server that returns a body different from the pinned digest passes the check.
An application that pins a response with a valid uppercase or mixed-case SRI token receives attacker-controlled bytes with no integrity error. The attacker needs only to control the response body, not the application's integrity metadata. The issue affects response integrity only. The regression was introduced in undici 7.15.0; releases 7.14.0 and earlier lowercase the token and are not affected.
Upgrade to 7.30.1 or 8.12.2. undici now normalizes the algorithm token to ASCII lowercase before validating it and before selecting the strongest algorithm, so case variants of SHA-256, SHA-384, and SHA-512 are verified correctly.
Use lowercase algorithm tokens (sha256, sha384, sha512) in integrity metadata.
This page as .md · .json · in your agent: get_signal("CVE-2026-109841")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.