Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Description

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 6.0.0, < 6.11.1

  < 5.28.4**

• Patched version(s): **6.11.1

  5.28.4**

References

• GHSA-9qxr-qj54-h672
• hackerone.com
• lists.fedoraproject.org
• CVE-2024-30261
• CWE-284
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• undici Denial of Service attack via bad certificate data - CVE-2025-47279
• Use of Insufficiently Random Values in undici - CVE-2025-22150
• fetch(url) leads to a memory leak in undici - CVE-2024-24750
• Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818

Tags:

npm

undici