15 matches found
EUVD-2026-102305
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens...
CVE-2026-114049
A flaw was found in vLLM. A remote attacker can compromise the integrity of responses generated for other users by submitting concurrent constrained generation requests. Due to improper state cleanup during batch reorganization, restriction rules defining permitted response tokens can persist in...
SUSE CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
UBUNTU-CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
Linux Distros Unpatched Vulnerability : CVE-2026-109841
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrit...
DEBIAN-CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
CVE-2026-109841 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
CVE-2026-109841 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
CVE-2026-109841
The undici HTTP client library for Node.js (versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1 ) contains a vulnerability in its fetch() implementation. The library incorrectly handles case sensitivity when verifying Subresource Integrity (SRI) metadata, treating valid but non-lowercase algo...
PT-2026-115120
Name of the Vulnerable Software and Affected Versions undici versions 7.15.0 through 7.30.0 undici versions 8.0.0 through 8.12.1 Description The fetch implementation in this Node.js HTTP client library incorrectly verifies Subresource Integrity SRI metadata. The library matches the algorithm toke...
CVE-2026-109841: Improper Handling of Case Sensitivity
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
Use of Cache Containing Sensitive Information
Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the /v1/responses endpoint, where tokensinput stores the salt on the engine input only when it is...
CLEANSTART-2026-EC11110 undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers
Multiple security vulnerabilities affect the apache-superset package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. See references for...