# CVE-2026-120423: undici Subresource Integrity bypass via whitespace in integrity metadata

Source: https://junglewise.ai/threats/cve-2026-120423-undici-is-an-http-client-for-node-js-in-versions-7-15-0-through  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-120423 · Severity: medium · CVSS 5.9 · Published 2026-11-06

undici is an HTTP client library for Node.js that fetch operations use to verify downloaded content hasn't been tampered with using Subresource Integrity (SRI) checksums. A flaw in how whitespace is handled when parsing SRI metadata allows an attacker who controls the server response to bypass the integrity check by wrapping digest values in tabs or other whitespace characters. This means attacker-controlled content can be delivered to applications without triggering an integrity validation error.

Technologies: [OpenJS Foundation Undici](https://junglewise.ai/threats/technologies/openjs-foundation-undici). Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-120423 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120423 being exploited in the wild.

**How severe is CVE-2026-120423?** Medium severity, with a CVSS score of 5.9, published 6 November 2026.

**Which products and versions are affected?** OpenJS Foundation Undici 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3.

**Is there a fix for CVE-2026-120423?** Yes: fixed in 7.30.2, 8.12.4. Until then: Supply SRI integrity metadata without surrounding whitespace, using a single space to separate multiple digests. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120423 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120423?** Check whether you run OpenJS Foundation Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.30.2, 8.12.4

Supply SRI integrity metadata without surrounding whitespace, using a single space to separate multiple digests.

## Technical details

The vulnerability exists in undici's SRI parsing logic, which splits integrity metadata only on spaces but the SRI specification requires splitting on any ASCII whitespace including tabs, line feeds, and form feeds. When a digest is preceded by whitespace, it is parsed as an unrecognized token and skipped; if all digests are skipped, undici treats the integrity list as empty and accepts the response. An attacker controlling the response body (but not the integrity metadata) can serve modified content that bypasses the integrity check. The issue affects response integrity verification only and was introduced in version 7.15.0.

## Affected products

- OpenJS Foundation undici 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3

## Timeline

- 2026-11-05: disclosed
- 2026-11-06: advisory

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/nodejs/undici/security/advisories/GHSA-r4pc-4jcp-7pqc](https://github.com/nodejs/undici/security/advisories/GHSA-r4pc-4jcp-7pqc)

## Related threats

- [undici cross-user cache disclosure via same-origin redirect](https://junglewise.ai/threats/cve-2026-120474-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7)
- [undici denial of service via unhandled exception in cache-interceptor](https://junglewise.ai/threats/cve-2026-120222-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7)
- [undici cache poisoning and cross-user disclosure via intermediate redirect](https://junglewise.ai/threats/cve-2026-116592-undici-is-an-http-client-for-node-js-in-versions-7-30-1-and-8-12)
- [undici HTTP client denial of service in decompress interceptor](https://junglewise.ai/threats/cve-2026-87029-undici-is-an-http-client-library-for-node-js-in-versions-7-15-0)
- [undici denial of service via TLS 1.2 certificate renegotiation](https://junglewise.ai/threats/cve-2026-87018-undici-is-an-http-client-library-for-node-js-in-versions-4-2-1)