undici CVE-2026-109841

Exploitation requires that the application call undici's fetch() with Subresource Integrity metadata whose algorithm token is NOT all-lowercase - i.e., an uppercase or mixed-case token such as 'SHA256-', 'Sha384-', or 'SHA512-' instead of the conventional 'sha256-'. In that case undici matches against a lowercase-only set, treats the token as unknown, and with no recognized algorithm remaining accepts any response body. The attacker must additionally control the returned response bytes (malicious/compromised origin server or a man-in-the-middle on the fetch channel). Limiting factors: applications that use the standard lowercase SRI tokens are unaffected (hence the upgrade-or-lowercase workaround), exploitation yields integrity compromise only (no confidentiality or availability), and affected versions are 7.15.0-7.30.0 and 8.0.0-8.12.1; 7.30.1 and 8.12.2 normalize the token to ASCII lowercase before validation.

This is a moderate, defense-in-depth integrity flaw rather than a high-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, base 5.9) is internally consistent with the description: network-reachable, no authentication, but high attack complexity because exploitation depends on a specific non-default pinning choice AND attacker control over the response body. Impact is confined to integrity (C:N/A:N), matching CWE-178 (improper handling of case sensitivity) - not information disclosure despite the input tag. No EPSS score, SSVC decision, KEV listing, or POC was provided in the intelligence; exploitation status is therefore 'no public exploit identified at time of analysis.' The signals do not conflict, but several are simply absent: there is no exploitation-probability (EPSS) or automatability signal to weigh. The realistic risk is bounded by the precondition that the victim application pinned an uppercase or mixed-case SRI token, which is uncommon since the overwhelmingly documented convention is lowercase. Net: a legitimate integrity regression worth patching on a normal cadence, not a widespread-exploitation priority.

A Node.js application uses undici's fetch() to retrieve a critical remote resource (e.g., a script or config) and pins it with an SRI integrity value using an uppercase or mixed-case algorithm token such as 'SHA256-...'. An attacker positioned to control the returned response body - via a compromised or malicious upstream server, or a man-in-the-middle on an unprotected channel - serves altered bytes; undici fails to recognize the capitalized token, treats the integrity list as empty, and accepts the tampered body with no error. No public exploit code was provided in the intelligence, and the high attack complexity reflects the required non-default token casing plus response-body control.