CVE-2024-30261CWE-284

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Low · published April 4, 2024

CVSS v3.1
2.6
EPSS
1%
Percentile
56.2
In the wild
Unconfirmed
What it is

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00803 · 56.2th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-04-04T15:09Z
EPSS history
Timeline
  • 04 APR 15:09Z
    Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
    cvelistv5