Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Description

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Recommendation

Update the undici package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 6.0.0, < 6.11.1

  < 5.28.4**

• Patched version(s): **6.11.1

  5.28.4**

References

• GHSA-9qxr-qj54-h672
• hackerone.com
• lists.fedoraproject.org
• security.netapp.com
• CVE-2024-30261
• CWE-284
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem - CVE-2024-23331
• fetch(url) leads to a memory leak in undici - CVE-2024-24750
• Undici vulnerable to data leak when using response.arrayBuffer() - CVE-2024-38372
• Undici proxy-authorization header not cleared on cross-origin redirect in fetch - CVE-2024-24758

Tags:

npm

undici