CVE-2026-109841

undici is an HTTP client library for Node.js.

Undici

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-lowercase form, so a valid but non-lowercase token such as an uppercase or mixed-case SHA256 is treated as unknown and skipped. When no recognized algorithm remains, undici treats…

15. Okt 2026

Ausgewertete Quellen

• Hersteller
  https://cna.openjsf.org/security-advisories.html
• NVD
  CVE-2026-109841
• GitHub
  https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472