CVE-2026-109841 Overview
CVE-2026-109841 affects undici, the HTTP client library used by Node.js and many downstream applications. The vulnerability lives in the fetch() implementation's Subresource Integrity (SRI) validation logic. Affected versions compare the algorithm token against a lowercase-only set, rejecting valid uppercase or mixed-case tokens as unknown. When no recognized algorithm remains, undici treats the integrity list as empty and accepts the response without verification. An attacker who controls the response body can deliver arbitrary bytes to applications that pinned a valid but non-lowercase SRI token, with no integrity error raised.
Critical Impact
Response body integrity checks silently pass for attacker-controlled content when SRI metadata uses uppercase or mixed-case algorithm tokens.
Affected Products
- nodejs/undici versions 7.15.0 through 7.30.0
- nodejs/undici versions 8.0.0 through 8.12.1
- Node.js applications relying on undici.fetch() with SRI metadata
Discovery Timeline
- 2026-10-15 - CVE-2026-109841 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-109841
Vulnerability Analysis
The flaw is an improper case-sensitive comparison bug classified under [CWE-178]. The Subresource Integrity specification defines the hash-algo production using the ASCII-lowercase form of the algorithm identifier. The specification also requires implementations to normalize incoming tokens before comparison. The affected undici releases skip that normalization step and compare the raw token against a hardcoded lowercase allowlist of sha256, sha384, and sha512.
When a developer pins a resource using an uppercase token such as SHA256-..., the parser discards the entry as unknown. If the integrity metadata contains only such entries, the resulting recognized-algorithm list is empty. The SRI algorithm then treats the empty list as "no integrity requirement" and returns success, regardless of the actual response body.
The impact is scoped to response integrity. Confidentiality and availability are unaffected because the TLS channel and request handling remain intact.
Root Cause
The parsing routine applies strict byte-equal matching against a lowercase token set rather than normalizing the user-supplied integrity value to ASCII lowercase before comparison. This diverges from the SRI specification, which mandates case-insensitive handling of the algorithm identifier.
Attack Vector
Exploitation requires an attacker who controls the response body returned to an undici.fetch() call that pins integrity using a non-lowercase token. The attacker does not need to break TLS or compromise the client. A compromised upstream server, a malicious mirror, or a man-in-the-middle on an unauthenticated channel can substitute content. The pinned digest is never actually evaluated, so swapped bytes pass without error.
No exploitation code is published for CVE-2026-109841 and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the GitHub Security Advisory GHSA-f72v-6w45-q472 for implementer details.
Detection Methods for CVE-2026-109841
Indicators of Compromise
- Application dependency manifests (package.json, package-lock.json, yarn.lock) pinning undici to any version from 7.15.0 through 7.30.0 or 8.0.0 through 8.12.1.
- Source code containing fetch() calls where the integrity option uses uppercase or mixed-case tokens such as SHA256-, Sha384-, or SHA512-.
- Fetched artifacts that differ from their pinned digest yet produce no runtime integrity error.
Detection Strategies
- Perform software composition analysis across build artifacts and container images to flag vulnerable undici versions.
- Grep application repositories for integrity: option values that do not begin with lowercase sha256-, sha384-, or sha512-.
- Compare downloaded resource hashes against expected digests in post-fetch logs and alert on mismatches.
Monitoring Recommendations
- Instrument HTTP client telemetry to record the integrity string, response size, and computed digest for outbound fetch() operations.
- Monitor dependency graphs for transitive pulls of vulnerable undici versions through frameworks such as Next.js, Fastify, or custom Node.js tooling.
- Alert on outbound requests to resource origins whose responses deviate from historical content hashes.
How to Mitigate CVE-2026-109841
Immediate Actions Required
- Upgrade undici to version 7.30.1 or 8.12.2 across all Node.js applications and container images.
- Audit application source for fetch() calls using the integrity option and normalize all algorithm tokens to lowercase.
- Rebuild and redeploy downstream services and serverless functions that bundle undici as a transitive dependency.
Patch Information
The maintainers fixed the issue in undici 7.30.1 and 8.12.2 by normalizing the algorithm token to ASCII lowercase before validating against the recognized algorithm set. See the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-f72v-6w45-q472 for release details.
Workarounds
- Use lowercase algorithm tokens (sha256, sha384, sha512) in all SRI integrity metadata until the patched version is deployed.
- Add a lint rule or pre-commit check that rejects integrity strings not matching the lowercase token format.
- Validate response bodies against expected hashes in application code as a defense-in-depth measure where upgrading is delayed.
# Configuration example
npm install undici@^7.30.1
# or for the 8.x branch
npm install undici@^8.12.2
# Verify no vulnerable versions remain in the dependency tree
npm ls undici
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
