CVE-2026-109841

A flaw was found in undici. The HTTP client improperly handles case sensitivity when verifying Subresource Integrity (SRI) algorithm tokens. When an application specifies an uppercase or mixed-case algorithm name, undici treats the token as unrecognized and skips verification instead of enforcing it. A remote attacker who controls the HTTP response body can exploit this flaw to deliver modified content without triggering an integrity error, bypassing intended security protections.

In Red Hat environments, this vulnerability is rated as Moderate impact because successful exploitation requires an adversary capable of tampering with network responses alongside the uncommon prerequisite that an application explicitly configured non-lowercase hashing algorithms for Subresource Integrity checks. Standard deployments typically employ lowercase digest names, which properly enforce validation and prevent bypass. Furthermore, the issue is constrained to compromising response integrity when client workloads rely on undici's fetch implementation under these specific naming conditions, without directly leading to system compromise or arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.