Subresource Integrity Bypass in undici HTTP Client Library for Node.js

CVE-2026-109841

What is CVE-2026-109841?

The undici HTTP client library for Node.js contains a vulnerability in its fetch() implementation, where the Subresource Integrity (SRI) metadata verification is faulty. Specifically, it incorrectly processes the algorithm token by comparing it against a lowercase-only set. As a result, valid tokens in uppercase or mixed-case formats are ignored, allowing an attacker to manipulate the response body. Thus, applications that rely on these tokens may inadvertently accept altered responses, compromising response integrity. This issue has been resolved in versions 7.30.1 and 8.12.2 of undici, which include fixes for normalizing the algorithm token to ASCII lowercase before validation.

References