undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3, fetch verifies Subresource Integrity metadata by splitting the integrity string on a single space, but the SRI grammar separates metadata by ASCII whitespace, which also includes the horizontal tab. An integrity value whose digest is preceded by a tab or other ASCII whitespace is parsed as a single unrecognized token and skipped, and when no recognized algorithm remains undici treats the integrity list as empty and accepts the response, so a server returning a body different from the pinned digest passes the check. An application that pins a response with a valid but whitespace-surrounded SRI value receives attacker-controlled bytes with no integrity error, and the attacker needs only to control the response body, not the integrity metadata. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, supply SRI integrity metadata without surrounding whitespace, using a single space to separate multiple digests.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…undici/security/advisories/GHSA-r4pc-4jcp-7pqc Diğer
• cna.openjsf.org/security-advisories.html Diğer

Kayıt geçmişi

1. 6 Kas 2026 13:08Yayımlandı

İlgili açıklar

• 5,9 CVE-2026-116630undici vulnerable to cross-user information disclosure via cross-origin redirect revalidation
• 5,9 CVE-2026-120415undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping
• 7,4 CVE-2026-116592undici HTTP istemcisinde yönlendirme zincirinde önbellek zehirlenmesi ve kullanıcılar arası veri sızıntısı
• 5,9 CVE-2026-120222undici vulnerable to Denial of Service via unhandled exception in cache-interceptor response replay
• 6,5 CVE-2026-120474undici vulnerable to cross-user cache disclosure via same-origin redirect
• 8,1 CVE-2026-123317JetBrains Ktor'da şifrelenmiş oturum çerezlerinin değiştirilmesiyle oturum sahteciliği