{"id":"CVE-2026-109841","kind":"vulnerability","aliases":["CVE-2026-109841","GHSA-f72v-6w45-q472"],"related":[],"title":"undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens","description":"### Impact\n\nundici's `fetch()` verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as `SHA256-...` or `Sha256-...` is therefore treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server that returns a body different from the pinned digest passes the check.\n\nAn application that pins a response with a valid uppercase or mixed-case SRI token receives attacker-controlled bytes with no integrity error. The attacker needs only to control the response body, not the application's integrity metadata. The issue affects response integrity only. The regression was introduced in undici 7.15.0; releases 7.14.0 and earlier lowercase the token and are not affected.\n\n### Patches\n\nUpgrade to `7.30.1` or `8.12.2`. undici now normalizes the algorithm token to ASCII lowercase before validating it and before selecting the strongest algorithm, so case variants of SHA-256, SHA-384, and SHA-512 are verified correctly.\n\n### Workarounds\n\nUse lowercase algorithm tokens (`sha256`, `sha384`, `sha512`) in `integrity` metadata.","summary":"undici's fetch() skips Subresource Integrity algorithm tokens that are valid but not lowercase, such as SHA256-, so a pinned digest is not checked. An attacker who controls the response body can serve different bytes to an application that pinned the response with such a token and receive no integrity error.","severity":"high","cvss":7.5,"epss":0.00251,"exploited":false,"exploited_at":null,"products":[{"name":"undici","fixed":["7.30.1"],"affected":">= 7.15.0, < 7.30.1","ecosystem":"npm"},{"name":"undici","fixed":["8.12.2"],"affected":">= 8.0.0, < 8.12.2","ecosystem":"npm"},{"name":"nodejs undici","fixed":["7.30.1"],"affected":">= 7.15.0, < 7.30.1","ecosystem":"vendor"},{"name":"nodejs undici","fixed":["8.12.2"],"affected":">= 8.0.0, < 8.12.2","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-178","fetch","node.js","npm","package","supply-chain","undici"],"not_affected_if":["lowercase-sri-tokens","no-integrity-metadata","undici-7.14.0-or-earlier","undici-patched"],"how_to_check":"- Run `npm ls undici` to list installed undici versions.\n- Search application code for `integrity:` options or `integrity` values in fetch calls that start with an uppercase or mixed-case algorithm such as `SHA256-`.\n- Confirm the undici version in use is `7.15.0` or later and below `7.30.1` or in `8.0.0` to below `8.12.2`.","fix":"- Upgrade undici to `7.30.1` on the 7.x line or `8.12.2` on the 8.x line.\n- Until upgraded, use lowercase algorithm tokens (`sha256`, `sha384`, `sha512`) in `integrity` metadata.","status":"open","published_at":"2026-10-15T19:17:21+00:00","first_seen_at":"2026-10-23T22:15:56+00:00","triaged_at":"2026-10-25T03:25:25+00:00","updated_at":"2026-10-25T03:25:25+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:25:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade undici to `7.30.1` on the 7.x line or `8.12.2` on the 8.x line.\n- Until upgraded, use lowercase algorithm tokens (`sha256`, `sha384`, `sha512`) in `integrity` metadata.","reach":"network","title":"undici: uppercase SRI tokens let fetch accept a mismatched response body","impact":"medium","summary":"undici's fetch() skips Subresource Integrity algorithm tokens that are valid but not lowercase, such as SHA256-, so a pinned digest is not checked. An attacker who controls the response body can serve different bytes to an application that pinned the response with such a token and receive no integrity error.","category":"package","nicknames":[],"who_cares":["node.js","npm","undici","fetch","supply-chain"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker-controlled bytes accepted as a pinned response with no integrity error.","analyst_note":"","how_to_check":"- Run `npm ls undici` to list installed undici versions.\n- Search application code for `integrity:` options or `integrity` values in fetch calls that start with an uppercase or mixed-case algorithm such as `SHA256-`.\n- Confirm the undici version in use is `7.15.0` or later and below `7.30.1` or in `8.0.0` to below `8.12.2`.","needs_analyst":false,"not_affected_if":["undici-7.14.0-or-earlier","undici-patched","no-integrity-metadata","lowercase-sri-tokens"],"who_is_affected":"Applications that use undici's fetch() with SRI `integrity` metadata to verify response bodies, on undici 7.15.0 to 7.30.0 or 8.0.0 to 8.12.1. The bug needs the pinned token to be valid but not lowercase, and the attacker must be able to control the response body, for example through a compromised or spoofed server or an intercepted connection. Releases 7.14.0 and earlier are not affected, and code that does not use integrity metadata with fetch() is not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":3862,"output_tokens":747,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109841':15A,23A '-178':31B '-2026':14A,22A '-256':269C '-384':271C '-512':274C '6w45':19A '7.14.0':230C '7.15.0':228C '7.30.1':243C '8.12.2':245C 'accept':158C 'affect':218C,239C 'algorithm':11A,46B,104C,148C,250C,263C,281C 'applic':77B,177C,212C 'ascii':123C,253C 'ascii-lowercas':122C 'attack':65B,194C,202C 'attacker-control':193C 'bodi':70B,167C,209C 'bypass':6A 'byte':74B,196C 'case':189C,265C 'chain':38B 'check':63B,175C 'control':67B,195C,206C 'correct':127C,277C 'cve':13A,21A 'cwe':30B 'defin':116C 'differ':73B,168C 'digest':60B,172C 'earlier':232C 'empti':156C 'error':90B,200C 'f72v':18A 'fetch':32B,42B,94C 'form':125C 'ghsa':17A 'ghsa-f72v-6w45-q472':16A 'impact':91C 'integr':5A,45B,89B,97C,153C,199C,214C,220C,287C 'introduc':225C 'issu':217C 'list':154C 'look':101C 'lowercas':10A,53B,109C,124C,131C,233C,254C,280C 'lowercase-on':108C 'metadata':99C,215C,288C 'mix':188C 'mixed-cas':187C 'need':203C 'node.js':33B 'nodejs':26A,28A 'non':9A,130C 'non-lowercas':8A,129C 'normal':248C 'npm':34B 'packag':35B 'pass':173C 'patch':240C 'pin':59B,79B,171C,179C 'q472':20A 'receiv':87B,192C 'recogn':147C 'regress':223C 'releas':229C 'remain':149C 'respons':69B,81B,160C,181C,208C,219C 'return':165C 'select':260C 'serv':72B 'server':163C 'set':111C 'sha':268C,270C,273C 'sha256':56B,135C,137C,283C 'sha384':284C 'sha512':285C 'skip':43B,144C 'specif':115C 'sri':98C,114C,190C 'strongest':262C 'subresourc':4A,44B,96C 'suppli':37B 'supply-chain':36B 'therefor':139C 'token':12A,47B,85B,105C,119C,132C,191C,235C,251C,282C 'treat':140C,151C 'undici':1A,24A,25A,27A,29A,39B,40B,92C,150C,227C,246C 'unknown':142C 'upgrad':241C 'uppercas':185C 'use':279C 'valid':50B,118C,184C,256C 'variant':266C 'verifi':95C,276C 'via':7A 'vulner':2A 'workaround':278C","nicknames":[],"mitigations":[],"who_affected":"Applications that use undici's fetch() with SRI `integrity` metadata to verify response bodies, on undici 7.15.0 to 7.30.0 or 8.0.0 to 8.12.1. The bug needs the pinned token to be valid but not lowercase, and the attacker must be able to control the response body, for example through a compromised or spoofed server or an intercepted connection. Releases 7.14.0 and earlier are not affected, and code that does not use integrity metadata with fetch() is not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-15T19:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-f72v-6w45-q472","url":"https://github.com/advisories/GHSA-f72v-6w45-q472","severity":"medium","published_at":"2026-10-23T22:12:57+00:00","modified_at":"2026-10-23T22:13:18+00:00","first_seen_at":"2026-10-23T22:15:56+00:00","fetched_at":"2026-10-23T22:15:56+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-109841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109841","severity":null,"published_at":"2026-10-15T19:17:21+00:00","modified_at":"2026-10-19T20:45:30+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}