CVE WATCH / VULNERABILITY DETAIL
CVE-2026-109841
MEDIUMCVSS 5.9NVD feed
Published 15 October 2026 · tracked since 16 October 2026
Description
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its ASCII-
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-111138 MEDIUM 5.5
- CVE-2026-110874 MEDIUM 6.6
- CVE-2026-110878 MEDIUM 5.4
- CVE-2026-109924 MEDIUM 5.9
- CVE-2026-109932 MEDIUM 5.9
- CVE-2026-109829 HIGH 7.4
- CVE-2026-109869 HIGH 7.5
- CVE-2026-109383 HIGH 7.4
- CVE-2026-104150
- CVE-2026-104827 HIGH 7.5