{"id":"ghsa-ghsa-f72v-6w45-q472","seq":661291,"kind":"advisory","title":"undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens","url":"https://github.com/advisories/GHSA-f72v-6w45-q472","permalink":"https://vulnpulse.app/items/ghsa-ghsa-f72v-6w45-q472","summary":"影響: npm:undici >= 7.15.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2\nundici's fetch() verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server that returns a body different from the pinned digest passes the check.…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-109841"],"tags":["GHSA-f72v-6w45-q472","undici","undici"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T22:12:57.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}