Undici Vulnerable To Subresource Integrity Bypass Via Non-lowercase Algorithm Tokens

Impact undici's "fetch" verifies Subresource Integrity SRI metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as "SHA256-..." or "Sha256-..." is therefore treated a...