LowGHSA-9qxr-qj54-h672CVE-2024-30261

Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

Published 4 Apr 2024 · Updated 4 Nov 2025

Affected packages

undicinpm

Affected: <5.28.4
Fixed in: 5.28.4

Update to the fixed version for your release line, for example:npm install undici@5.28.4

undicinpm

Affected: >=6.0.0 <6.11.1
Fixed in: 6.11.1

Update to the fixed version for your release line, for example:npm install undici@6.11.1

Details

Impact

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Patches

Fixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3. Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

Ensure that integrity cannot be tampered with.

References

https://hackerone.com/reports/2377760

Is GHSA-9qxr-qj54-h672 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected undici, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.