CVE-2026-109841: CVE-2026-109841: Subresource Integrity Verification Bypass in Node.js Undici

#security #cve #cybersecurity

CVE-2026-109841: Subresource Integrity Verification Bypass in Node.js Undici

Vulnerability ID: CVE-2026-109841
CVSS Score: 5.9
Published: 2026-10-23

CVE-2026-109841 is a Subresource Integrity (SRI) verification bypass vulnerability in undici, the official HTTP/1.1 and HTTP/2 client library for Node.js that powers the global fetch() implementation. The flaw stems from improper handling of case sensitivity (CWE-178) when validating cryptographic hash algorithm tokens within SRI metadata. Because undici compared incoming algorithm identifiers against a strictly lowercase set without prior ASCII-lowercase normalization, valid uppercase or mixed-case tokens such as SHA256- or Sha384- were treated as unrecognized algorithms and discarded. Under SRI forward-compatibility rules, discarding all provided tokens results in an empty integrity list, causing undici to fail open and accept tampered HTTP response bodies without cryptographic verification.

TL;DR

Undici versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1 fail to normalize Subresource Integrity (SRI) hash algorithm tokens to ASCII lowercase before validation. When an application specifies uppercase or mixed-case SRI tokens (e.g., SHA256-...), undici treats them as unknown algorithms, skips digest verification, and accepts arbitrary attacker-controlled response bodies. Users should upgrade to undici 7.30.1 or 8.12.2, or enforce lowercase algorithm names in integrity strings.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Class: CWE-178: Improper Handling of Case Sensitivity
Affected Component: undici (lib/web/subresource-integrity/subresource-integrity.js)
Attack Vector: Network (Tampered HTTP Response Body)
CVSS v3.1 Score: 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
EPSS Score: 0.25% (15.69th Percentile)
Security Impact: Subresource Integrity (SRI) Verification Bypass (High Integrity Loss)
Exploit Status: Proof-of-Concept Available (Regression Test)
Patched Versions: undici 7.30.1 and 8.12.2

Affected Systems

Node.js undici (7.15.0 through 7.30.0)
Node.js undici (8.0.0 through 8.12.1)
Node.js runtime environments bundling affected undici versions for global fetch()
undici: >= 7.15.0, <= 7.30.0 (Fixed in: 7.30.1)
undici: >= 8.0.0, <= 8.12.1 (Fixed in: 8.12.2)

Code Analysis

Commit: 4f7ef68

Normalize SRI hash algorithm token to ASCII lowercase before validation and storage.

@@ -2,6 +2,7 @@

 const assert = require('node:assert')
 const { runtimeFeatures } = require('../../util/runtime-features.js')
+const { asciiLowercase } = require('../infra/index.js')

 /**
  * @typedef {object} Metadata
@@ -66,14 +67,12 @@ const getSRIHashAlgorithmIndex = /** @type {GetSRIHashAlgorithmIndex} */ (Map.prototype.get.bind(validSRIHashAlgorithmTokenSet))

 /**
  * @typedef IsValidSRIHashAlgorithm
+ * @see https://w3c.github.io/webappsec-subresource-integrity/#valid-sri-hash-algorithm-token
  * @type {(algorithm: string) => algorithm is SRIHashAlgorithm}
  * @param {*} algorithm
  * @returns {algorithm is SRIHashAlgorithm}
  */
-const isValidSRIHashAlgorithm = /** @type {IsValidSRIHashAlgorithm} */ (
-  Map.prototype.has.bind(validSRIHashAlgorithmTokenSet)
-)
+const isValidSRIHashAlgorithm = (algorithm) => validSRIHashAlgorithmTokenSet.has(asciiLowercase(algorithm))

 /**
  * @param {Uint8Array} bytes
@@ -229,7 +228,8 @@ function parseMetadata (metadata) {
     // 8. Let metadata be the ordered map
     // «["alg" → algorithm, "val" → base64-value]».
     const metadata = {
-      alg: algorithm,
+      // Possible spec bug?
+      alg: asciiLowercase(algorithm),
       val: base64Value
     }

Commit: 18bc8a1

Backport commit normalizing SRI algorithm token to ASCII lowercase.

Exploit Details

GitHub: Official regression test (test/subresource-integrity/GHSA-f72v-6w45-q472.js) demonstrating the SRI bypass using uppercase algorithm tokens.

Mitigation Strategies

Upgrade undici to patched releases (7.30.1+ or 8.12.2+) across all Node.js services and build pipelines.
Enforce lowercase algorithm prefixes (sha256-, sha384-, sha512-) in all static and dynamically loaded Subresource Integrity strings.
Implement pre-fetch input normalization on user-supplied or configuration-driven integrity strings to ensure only the algorithm prefix (before the hyphen) is converted to ASCII lowercase.

Remediation Steps:

Audit project lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) using 'npm ls undici' to identify versions within 7.15.0 - 7.30.0 or 8.0.0 - 8.12.1.
Run 'npm update undici' or explicitly install 'undici@7.30.1' or 'undici@8.12.2' depending on your major version track.
Search application source code and configuration files for 'integrity' properties containing uppercase or mixed-case prefixes such as 'SHA256-', 'SHA384-', or 'SHA512-' and convert the algorithm prefix to lowercase.
Verify the fix by running automated tests confirming that fetch() throws a TypeError ('integrity mismatch') when an uppercase SRI token does not match the response payload.

References

Read the full report for CVE-2026-109841 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community