CVE-2026-109841

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata.

• CWE-178

• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472

Published

Oct 15, 2026

Last Modified

Oct 16, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10983Insufficient validation of untrusted input in Dawn in Google…9.6
• CVE-2026-109832A flaw was found in gnome-remote-desktop as shipped in Red H…7.5
• CVE-2026-109833A flaw was found in gnome-remote-desktop as shipped in Red H…5.9
• CVE-2026-109838IBM Db2 Genius Hub 1.0 could allow a local attacker to obtai…5.1
• CVE-2026-109839IBM Db2 Genius Hub 1.0 could allow a remote authenticated at…3.1
• CVE-2026-10984Inappropriate implementation in Accessibility in Google Chro…5.4
• CVE-2026-109844`GET /api/v1/user/subscriptions` returned the metadata of ev…
• CVE-2026-10985Out of bounds read in Skia in Google Chrome prior to 149.0.7…6.5
• CVE-2026-109854A flaw was found in m17n-lib. An attacker who supplies craft…2.5
• CVE-2026-109855undici is an HTTP client library for Node.js. In versions 8.…7.5
• CVE-2026-10986Integer overflow in Media in Google Chrome prior to 149.0.78…8.8
• CVE-2026-109869undici is an HTTP client library for Node.js. In versions 6.…7.5