Cloudanix VulnDB

CVE-2026-109841

Medium · 5.9

CVSS

5.9

EPSS

0.3%

Published

Oct 15, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A web request library used by Node.js programs could let changed or harmful content pass through safety checks when the check instructions contain capital letters instead of all lowercase.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Data Tampering
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Bypasses Subresource Integrity verification in fetch() by failing to recognize non-lowercase algorithm tokens, treating the integrity list as empty and accepting response bodies that do not match the pinned digest.

Why it matters to the business

Applications depending on SRI for response integrity may silently accept tampered or attacker-controlled content, increasing risk of data tampering or malicious payload delivery in environments using affected Node.js packages.

How an attack unfolds

An attacker who can influence the HTTP response body supplies a valid but non-lowercase SRI token such as SHA256; the library skips the check because the token is unrecognized, delivering the mismatched body without raising an integrity error.

How to fix it

Upgrade undici to 7.30.1 or later, or 8.12.2 or later. For Red Hat packages upgrade nodejs24-main to 24.21.0-1.5.hum1 and nodejs26-main to 11.20.0-1.26.11.1.0.4.hum1. As a temporary measure ensure all SRI algorithm tokens are emitted in lowercase.

How to confirm the fix worked

Confirm the installed undici version meets or exceeds the fixed releases, then test fetch calls that include mixed-case SRI tokens to verify mismatched bodies are now rejected.

Typical attack path

  1. Gain network position to control or modify responses to fetch requests that specify SRI metadata
  2. Return a body that does not match the declared digest while using an uppercase or mixed-case algorithm token
  3. Library normalizes nothing and treats the token as unknown, accepting the response
  4. Application consumes attacker-controlled bytes with no integrity error raised

How to detect it

Review application and proxy logs for fetch requests that specify integrity metadata yet receive responses without corresponding integrity errors; correlate with network captures showing unexpected body content.

What your security team should do

  • Apply the listed package upgrades on all affected Red Hat Node.js deployments without delay
  • Audit codebases for SRI usage and enforce lowercase algorithm tokens until patches are deployed
  • Add dependency version checks to build and deployment pipelines to prevent reintroduction of vulnerable undici releases

The record

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server returning a body that does not match the pinned digest passes the check. An attacker who controls only the response body can therefore deliver attacker-controlled bytes to an application that pinned a valid uppercase or mixed-case SRI token, with no integrity error, affecting response integrity only. The issue is fixed in undici 7.30.1 and 8.12.2, which normalize the algorithm token to ASCII lowercase before validation, and users should upgrade to one of those versions or later. As a workaround, use lowercase algorithm tokens such as sha256, sha384, or sha512 in integrity metadata.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities