HTTP Client Vulnerability in Undici Affects Node.js Applications

CVE-2026-120423

What is CVE-2026-120423?

Undici, an HTTP client for Node.js, has a vulnerability that arises from improper handling of Subresource Integrity (SRI) metadata. In specified versions of Undici, the client splits the integrity string using a single space, which leads to issues when the integrity value contains ASCII whitespace, particularly horizontal tabs. This parsing flaw allows an attacker to provide a response body that does not match the intended digest without raising an integrity error, as recognized algorithms may be bypassed. The vulnerability affects applications relying on SRI for content integrity, enabling potential exposure to harmful payloads. Users are advised to upgrade to Undici versions 7.30.2 or 8.12.4 or later to mitigate this issue, or alternatively, ensure that integrity metadata is supplied without surrounding whitespace.

References