Description

undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, which also includes the horizontal tab. An integrity value whose digest is preceded by a tab or other ASCII whitespace is parsed as a single unrecognized token and skipped, and when no recognized algorithm remains undici treats the integrity list as empty and accepts the response, so a server returning a body different from the pinned digest passes the check. An application that pins a response with a valid but whitespace-surrounded SRI value receives attacker-controlled bytes with no integrity error, and the attacker needs only to control the response body, not the integrity metadata. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, supply SRI integrity metadata without surrounding whitespace, using a single space to separate multiple digests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-11-06T10:16:36.780Z",
  "pubdate": "2026-11-06T10:16:36.780Z",
  "executiveSummary": "Undici contains a security vulnerability in its Subresource Integrity (SRI) verification logic, specifically within the fetch implementation. The vulnerability is classified as an integrity validation bypass, allowing an attacker to supply malicious or unauthorized payloads that circumvent cryptographic checksum verification.\nThe flaw exists in how the library parses integrity metadata strings. By using an insufficient splitting mechanism that only recognizes single space characters as delimiters, the parser fails to correctly interpret the full SRI grammar, which includes other ASCII whitespace characters such as horizontal tabs. If an integrity metadata string contains these ignored characters, the parser fails to identify the intended cryptographic digests, causing the library to treat the integrity list as empty. Consequently, the fetch implementation defaults to a permissive state, accepting any response body without enforcing the intended hash constraints.\nThis vulnerability exposes applications relying on Undici for secure resource fetching to potential data integrity compromises. An attacker capable of influencing the response body of an external resource can successfully bypass pinned integrity checks, leading to the execution or processing of unverified and potentially malicious content. The impact is significant for applications using SRI to ensure the provenance and immutability of fetched assets.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper implementation of the Subresource Integrity (SRI) specification parser within the Undici fetch module. The SRI specification defines the integrity attribute value as a set of whitespace-separated tokens, where 'whitespace' includes a broader range of ASCII characters than just the single space (U+0020), specifically encompassing horizontal tabs (U+0009), line feeds (U+000A), and carriage returns (U+000D).\nUndici's implementation uses a string splitting operation that only accounts for the single space character. When an integrity string is provided that includes non-space ASCII whitespace—such as a tab character before the digest—the parser fails to tokenize the string according to the specification. Specifically, the parser interprets the improperly spaced integrity metadata as a single unrecognized token. Because no recognized cryptographic algorithm/digest pairs are successfully identified during this faulty parsing process, the internal state of the integrity checker defaults to an empty list. In this state, the library logic incorrectly concludes that there are no integrity requirements to satisfy and implicitly treats the validation as successful, regardless of the actual content of the response body.\nThe exploitation flow proceeds as follows: An attacker identifies an application that fetches a resource using Undici where the integrity metadata is provided in a format containing tab-prefixed or tab-separated digests. The attacker then intercepts or substitutes the target resource body. Because the parser skips the 'invalid' (but technically valid per spec) SRI string due to the tab character, the fetch process ignores the expected hash. The client accepts the malicious response body as authentic because the integrity check was effectively bypassed due to the parser error. This requires no authentication or special privileges, as the vulnerability resides in the core parsing logic of the client-side library.\nThis vulnerability affects Undici versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3. The failure to adhere to the standard SRI grammar results in a security-critical 'fail-open' behavior, where the lack of successfully parsed metadata leads to the acceptance of arbitrary, unverified content, undermining the fundamental security objectives of Subresource Integrity."
}