144 matches found
CVE-2026-120423
undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, which also includes the horizontal tab. ...
CVE-2026-120423 undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata
undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, which also includes the horizontal tab. ...
CVE-2026-120423
The undici HTTP client for Node.js (versions 7.15.0-7.30.1 and 8.0.0-8.12.3) contains a vulnerability where Subresource Integrity (SRI) metadata is incorrectly parsed. The component splits the integrity string on a single space, but the SRI grammar allows other ASCII whitespace, such as horizonta...
UBUNTU-CVE-2026-120423
undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, which also includes the horizontal tab. ...
CVE-2026-120423: undici: undici is an HTTP client for Node.js
undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, which also includes the horizontal tab. ...
CLEANSTART-2024-AS26968 When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata
Security vulnerability affects the librewolf package. When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata...
Undici Vulnerable To Subresource Integrity Bypass Via Non-lowercase Algorithm Tokens
Impact undici's "fetch" verifies Subresource Integrity SRI metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as "SHA256-..." or "Sha256-..." is therefore treated a...
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
Impact undici's fetch verifies Subresource Integrity SRI metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as...
npm: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
npm: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens vulnerability discovered by ? in WordPress npm undici versions = 7.15.0, 7.30.1...
GHSA-F72V-6W45-Q472 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
Impact undici's fetch verifies Subresource Integrity SRI metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as...
EUVD-2026-102305
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens...
SUSE CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens
A flaw was found in undici. The HTTP client improperly handles case sensitivity when verifying Subresource Integrity SRI algorithm tokens. When an application specifies an uppercase or mixed-case algorithm name, undici treats the token as unrecognized and skips verification instead of enforcing i...
undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens
A flaw was found in undici. The HTTP client improperly handles case sensitivity when verifying Subresource Integrity SRI algorithm tokens. When an application specifies an uppercase or mixed-case algorithm name, undici treats the token as unrecognized and skips verification instead of enforcing i...
UBUNTU-CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
Linux Distros Unpatched Vulnerability : CVE-2026-109841
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrit...
Improper Handling of Case Sensitivity
Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the fetch implementation's Subresource Integrity SRI verification logic, which matches the algorithm token again...
Improper Handling of Case Sensitivity
Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the fetch implementation's Subresource Integrity SRI verification logic, which matches the algorithm token against a...
DEBIAN-CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...