{"schema_version":"1.9.0","id":"GHSA-9qxr-qj54-h672","published":"2024-04-04T14:20:54Z","modified":"2025-11-04T19:44:42Z","aliases":["CVE-2024-30261"],"summary":"Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect","details":"### Impact\n\nIf an attacker can alter the `integrity` option passed to `fetch()`, they can let `fetch()` accept requests as valid even if they have been tampered.\n\n### Patches\n\nFixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3.\nFixes has been released in v5.28.4 and v6.11.1.\n\n\n### Workarounds\n\nEnsure that `integrity` cannot be tampered with.\n\n### References\n\nhttps://hackerone.com/reports/2377760","affected":[{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.28.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-9qxr-qj54-h672/GHSA-9qxr-qj54-h672.json"}},{"package":{"name":"undici","ecosystem":"npm","purl":"pkg:npm/undici"},"ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.11.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-9qxr-qj54-h672/GHSA-9qxr-qj54-h672.json"}}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30261"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3"},{"type":"WEB","url":"https://hackerone.com/reports/2377760"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240905-0008"}],"database_specific":{"cwe_ids":["CWE-284"],"github_reviewed":true,"github_reviewed_at":"2024-04-04T14:20:54Z","nvd_published_at":"2024-04-04T15:15:39Z","severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N"}]}