Subresource Integrity bypass in undici via whitespace in integrity metadata
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
undici, an HTTP client for Node.js, is affected in versions from 7.15.0 before 7.30.2 and from 8.0.0 before 8.12.4. Its fetch splits Subresource Integrity metadata on a single space, so a digest preceded by a tab or other ASCII whitespace is skipped as an unrecognized token. This is an improper validation of integrity check value (CWE-354). A remote attacker who controls only the response body can serve different bytes than the pinned digest, and the application receives them with no integrity error.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, which also includes the horizontal tab. An integrity value whose digest is preceded by a tab or other ASCII whitespace is parsed as a single unrecognized token and skipped, and when no recognized algorithm remains undici treats the integrity list as empty and accepts the response, so a server returning a body different from the pinned digest passes the check. An application that pins a response with a valid but whitespace-surrounded SRI value receives attacker-controlled bytes with no integrity error, and the attacker needs only to control the response body, not the integrity metadata. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, supply SRI integrity metadata without surrounding whitespace, using a single space to separate multiple digests.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Upgrade undici to version 7.30.2 or 8.12.4, which fix the flaw in the 7.x and 8.x branches respectively. As a workaround, supply SRI integrity metadata without surrounding whitespace, using a single space to separate multiple digests.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA undici (undici) Fixed in 7.30.2, 8.12.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
undici 7.30.2, 8.12.4
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-85807 Cache poisoning in undici via intermediate redirect hopsPriority LOW 32
- TI-2026-85805 Cross-user cache disclosure in undici via same-origin redirectPriority LOW 29
- TI-2026-85809 undici leaks cross-origin credentials via array-of-tuples headers on redirectPriority LOW 26
Timeline
- 2026-11-06 Threatist record created from CVE-2026-120423
- 2026-11-08 Priority changed: MEDIUM → LOW
References
More NodeJS vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2024-18584 Race condition in NodeJS Node CVSS 3.0HIGH 8.2
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
- TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences