Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
CVE-2024-30261

2.6LOW

Key Information:

Vendor

Nodejs

Status
Undici
Vendor
CVE Published:
4 April 2024

What is CVE-2024-30261?

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Affected Version(s)

undici >= 6.0.0, < 6.11.1 < 6.0.0, 6.11.1

undici < 5.28.4 < 5.28.4

References

https://github.com/nodejs/undici/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/nodejs/undici/commit/2b39440bd9ded841c...
x_refsource_MISC
https://github.com/nodejs/undici/commit/d542b8cd39ec1ba30...
x_refsource_MISC

CVSS V3.1

Score:
2.6
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.