GHSA-F72V-6W45-Q472 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

Impact undici's fetch verifies Subresource Integrity SRI metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as...

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

Impact undici's fetch verifies Subresource Integrity SRI metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as...

npm: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

npm: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens vulnerability discovered by ? in WordPress npm undici versions = 7.15.0, 7.30.1...

EUVD-2026-102305

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens...

SUSE CVE-2026-109841

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens

A flaw was found in undici. The HTTP client improperly handles case sensitivity when verifying Subresource Integrity SRI algorithm tokens. When an application specifies an uppercase or mixed-case algorithm name, undici treats the token as unrecognized and skips verification instead of enforcing i...

undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens

A flaw was found in undici. The HTTP client improperly handles case sensitivity when verifying Subresource Integrity SRI algorithm tokens. When an application specifies an uppercase or mixed-case algorithm name, undici treats the token as unrecognized and skips verification instead of enforcing i...

UBUNTU-CVE-2026-109841

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

Linux Distros Unpatched Vulnerability : CVE-2026-109841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrit...

Improper Handling of Case Sensitivity

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the fetch implementation's Subresource Integrity SRI verification logic, which matches the algorithm token against a...

Improper Handling of Case Sensitivity

Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the fetch implementation's Subresource Integrity SRI verification logic, which matches the algorithm token again...

DEBIAN-CVE-2026-109841

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

CVE-2026-109841

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

CVE-2026-109841

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

CVE-2026-109841

The undici HTTP client library for Node.js (versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1 ) contains a vulnerability in its fetch() implementation. The library incorrectly handles case sensitivity when verifying Subresource Integrity (SRI) metadata, treating valid but non-lowercase algo...

CVE-2026-109841 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

CVE-2026-109841

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

CVE-2026-109841 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

CVE-2026-109841 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...

Astra Linux – Vulnerability in Firefox

When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox 103...