Is CVE-2026-109841 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109841 being exploited in the wild.

How severe is CVE-2026-109841?

Medium severity, with a CVSS score of 5.9, published 15 October 2026.

Which products and versions are affected?

undici (npm) >= 7.15.0, < 7.30.1, SEMVER:introduced=7.15.0,fixed=7.30.1; OpenJS Foundation Undici 7.15.0 through 7.30.0, 8.0.0 through 8.12.1.

How is CVE-2026-109841 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-109841?

Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109841: undici Subresource Integrity bypass via non-lowercase algorithm tokens

Q: Is there a fix for CVE-2026-109841?

Yes. undici (npm): upgrade to 7.30.1 or later. Until then: Use lowercase algorithm tokens (sha256, sha384, sha512) in integrity metadata until upgrading to patched versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-109841 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-109841?

Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109841 · Severity: medium · CVSS 5.9 · Published 2026-10-15

undici is an HTTP client library for Node.js that implements the fetch() API and supports Subresource Integrity (SRI) to verify response bodies match pinned cryptographic hashes. A flaw in versions 7.15.0–7.30.0 and 8.0.0–8.12.1 treats non-lowercase algorithm tokens (e.g., "SHA256" instead of "sha256") as invalid, causing the library to skip validation entirely and accept any response body from the server. An attacker controlling the server response can deliver arbitrary content to applications that use mixed-case or uppercase SRI tokens, bypassing integrity checks.

Technologies: undici (npm), OpenJS Foundation Undici. Vendors: npm, OpenJS Foundation.

Quick answers

Is CVE-2026-109841 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109841 being exploited in the wild.
How severe is CVE-2026-109841?: Medium severity, with a CVSS score of 5.9, published 15 October 2026.
Which products and versions are affected?: undici (npm) >= 7.15.0, < 7.30.1, SEMVER:introduced=7.15.0,fixed=7.30.1; OpenJS Foundation Undici 7.15.0 through 7.30.0, 8.0.0 through 8.12.1.
Is there a fix for CVE-2026-109841?: Yes. undici (npm): upgrade to 7.30.1 or later. Until then: Use lowercase algorithm tokens (sha256, sha384, sha512) in integrity metadata until upgrading to patched versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109841 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-109841?: Check whether you run undici (npm) or OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

undici (npm): upgrade to 7.30.1 or later
```
npm install undici@7.30.1
```

Use lowercase algorithm tokens (sha256, sha384, sha512) in integrity metadata until upgrading to patched versions.

Technical details

undici's fetch() implementation validates Subresource Integrity by checking algorithm tokens against a lowercase-only set, deviating from the SRI spec which defines tokens in ASCII-lowercase form. When a valid but non-lowercase token (e.g., "SHA256-...") is encountered, it is treated as unknown and skipped; if no recognized algorithm remains, the integrity list is treated as empty and the response is accepted without verification. The attacker needs only control of the response body, not the SRI metadata, to deliver arbitrary content. This affects response integrity but not confidentiality or availability.

Affected products

OpenJS Foundation undici 7.15.0 through 7.30.0, 8.0.0 through 8.12.1

Identifiers

CVE-2026-109841
GHSA-f72v-6w45-q472

Timeline

2026-10-15: disclosed
2026-10-15: patched: Fixed in 7.30.1 and 8.12.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.