GHSA-f72v-6w45-q472: Medium severity npm/undici vulnerability
Impact
undici's fetch() verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as unknown and skipped. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response, so a server that returns a body different from the pinned digest passes the check.
An application that pins a response with a valid uppercase or mixed-case SRI token receives attacker-controlled bytes with no integrity error. The attacker needs only to control the response body, not the application's integrity metadata. The issue affects response integrity only. The regression was introduced in undici 7.15.0; releases 7.14.0 and earlier lowercase the token and are not affected.
Patches
Upgrade to 7.30.1 or 8.12.2. undici now normalizes the algorithm token to ASCII lowercase before validating it and before selecting the strongest algorithm, so case variants of SHA-256, SHA-384, and SHA-512 are verified correctly.
Workarounds
Use lowercase algorithm tokens (sha256, sha384, sha512) in integrity metadata.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 8.12.2 - Upgrade
Upgrade
npm/undicito a version that resolves this vulnerability.Fixed in 7.30.1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 7.30.1 - Upgrade
Upgrade
undicito a version that resolves this vulnerability.Fixed in 8.12.2 - Configuration
Use lowercase algorithm tokens such as sha256, sha384, and sha512 in integrity metadata.
undici fetch() SRI integrity metadata algorithm tokens = lowercase (sha256, sha384, sha512)
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using undici fetch() are exposed when they supply SRI metadata with a valid SHA-256, SHA-384, or SHA-512 algorithm token that contains uppercase or mixed-case characters. The issue affects response integrity verification only.
What must an attacker be able to do?
An attacker needs to control the response body returned to the application. They do not need to alter the application's integrity metadata.
Which versions are affected and how should they be remediated?
The regression was introduced in undici 7.15.0; version 7.14.0 and earlier are not affected. Upgrade to undici 7.30.1 or 8.12.2.
What can be done if an upgrade is not immediately possible?
Use lowercase algorithm tokens in SRI metadata. Lowercase tokens are recognized and verified rather than skipped.