Is CVE-2026-120423 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120423 being exploited in the wild.

How severe is CVE-2026-120423?

Medium severity, with a CVSS score of 5.9, published 6 November 2026.

Which products and versions are affected?

OpenJS Foundation Undici 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3.

How is CVE-2026-120423 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120423?

Check whether you run OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120423: undici Subresource Integrity bypass via whitespace in integrity metadata

CVE-2026-120423 · Severity: medium · CVSS 5.9 · Published 2026-11-06

undici is an HTTP client library for Node.js that fetch operations use to verify downloaded content hasn't been tampered with using Subresource Integrity (SRI) checksums. A flaw in how whitespace is handled when parsing SRI metadata allows an attacker who controls the server response to bypass the integrity check by wrapping digest values in tabs or other whitespace characters. This means attacker-controlled content can be delivered to applications without triggering an integrity validation error.

Technologies: OpenJS Foundation Undici. Vendors: OpenJS Foundation.

Quick answers

Is CVE-2026-120423 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120423 being exploited in the wild.
How severe is CVE-2026-120423?: Medium severity, with a CVSS score of 5.9, published 6 November 2026.
Which products and versions are affected?: OpenJS Foundation Undici 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3.
Is there a fix for CVE-2026-120423?: Yes: fixed in 7.30.2, 8.12.4. Until then: Supply SRI integrity metadata without surrounding whitespace, using a single space to separate multiple digests. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120423 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120423?: Check whether you run OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 7.30.2, 8.12.4

Supply SRI integrity metadata without surrounding whitespace, using a single space to separate multiple digests.

Technical details

The vulnerability exists in undici's SRI parsing logic, which splits integrity metadata only on spaces but the SRI specification requires splitting on any ASCII whitespace including tabs, line feeds, and form feeds. When a digest is preceded by whitespace, it is parsed as an unrecognized token and skipped; if all digests are skipped, undici treats the integrity list as empty and accepts the response. An attacker controlling the response body (but not the integrity metadata) can serve modified content that bypasses the integrity check. The issue affects response integrity verification only and was introduced in version 7.15.0.

Affected products

OpenJS Foundation undici 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3

Timeline

2026-11-05: disclosed
2026-11-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.