Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

🗓️ 04 Apr 2024 14:20:54Reported by GitHub Advisory DatabaseType

Undici's fetch with integrity option vulnerabilit

Reporter	Title	Published	Views	Family All 69
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	17 Sep 202422:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to loss of confidentiality due to [CVE-2024-30260] [CVE-2024-30261]	23 Apr 202414:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to a remote authenticated attacker (CVE-2024-30260, CVE-2024-30261)	21 Jun 202415:18	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	14 Aug 202409:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to bypass security restriction due to Node.js undici module ( CVE-2024-30261, CVE-2024-30260 )	8 Aug 202415:45	–	ibm
Tenable Nessus	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-594)	29 Apr 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2024-694)	6 Aug 202400:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: nodejs / nodejs18 (CVE-2024-30261)	10 Feb 202500:00	–	nessus
Tenable Nessus	Fedora 38 : nodejs-undici (2024-6d9c1da54f)	12 Apr 202400:00	–	nessus
Tenable Nessus	Fedora 40 : nodejs-undici (2024-a5dc987f91)	29 Apr 202400:00	–	nessus

Vulners

Node

nodejs undiciRange6.0.0–6.11.1npm

nodejs undiciRange<5.28.4npm

Source	Link
github	www.github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672
github	www.github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055
github	www.github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3
hackerone	www.hackerone.com/reports/2377760
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-30261
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ
security	www.security.netapp.com/advisory/ntap-20240905-0008
github	www.github.com/advisories/GHSA-9qxr-qj54-h672

04 Nov 2025 19:44Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.12.6 - 3.5

EPSS0.00066

SSVC