undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

影響: npm:undici >= 7.15.0, < 7.30.1 → 7.30.1, npm:undici >= 8.0.0, < 8.12.2 → 8.12.2

undici's fetch() verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server that returns a body different from the pinned digest passes the check.…

GitHub Advisory Databaseで読む

2026/10/24 07:12、GitHub Advisory Databaseが「undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-109841。