GHSA-9QXR-QJ54-H672 Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

🗓️ 04 Apr 2024 14:20:54Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Undici fetch integrity is too lax when an algorithm is set and the hash is incorrect, enabling tampering.

Reporter	Title	Published	Views	Family All 70
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js	17 Sep 202422:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to loss of confidentiality due to [CVE-2024-30260] [CVE-2024-30261]	23 Apr 202414:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to a remote authenticated attacker (CVE-2024-30260, CVE-2024-30261)	21 Jun 202415:18	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	14 Aug 202409:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to bypass security restriction due to Node.js undici module ( CVE-2024-30261, CVE-2024-30260 )	8 Aug 202415:45	–	ibm
Tenable Nessus	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-594)	29 Apr 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2024-694)	6 Aug 202400:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: nodejs / nodejs18 (CVE-2024-30261)	10 Feb 202500:00	–	nessus
Tenable Nessus	Fedora 38 : nodejs-undici (2024-6d9c1da54f)	12 Apr 202400:00	–	nessus
Tenable Nessus	Fedora 40 : nodejs-undici (2024-a5dc987f91)	29 Apr 202400:00	–	nessus

Source	Link
github	www.github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-30261
github	www.github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055
github	www.github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3
hackerone	www.hackerone.com/reports/2377760
github	www.github.com/nodejs/undici
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E
security	www.security.netapp.com/advisory/ntap-20240905-0008

04 Nov 2025 19:44Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.12.6

EPSS0.00803