{"action":"Upgrade undici to 7.30.1 (7.x) or 8.12.2 (8.x) or later.","affected":[{"fixed":"7.30.1","introduced":"7.15.0"},{"fixed":"8.12.2","introduced":"8.0.0"}],"component":"undici","cve_ids":["CVE-2026-109841"],"ecosystem":"npm","epss":0.00251,"exploited":false,"fixed_versions":["7.30.1","8.12.2"],"ghsa_id":"GHSA-f72v-6w45-q472","id":"tcs_01M5NFY8M468TFAQYG3JX5X8DW","modified_at":"2026-10-23T22:30:04.094314933Z","published_at":"2026-10-23T22:12:57Z","references":["https://osv.dev/vulnerability/GHSA-f72v-6w45-q472","https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472","https://nvd.nist.gov/vuln/detail/CVE-2026-109841","https://github.com/nodejs/undici/commit/18bc8a1e09d15bc45815154a289dcf6fd5254d00","https://github.com/nodejs/undici/commit/4f7ef6806e532ab9e29ccd6229b1b9d241e1b1f0","https://cna.openjsf.org/security-advisories.html","https://github.com/nodejs/undici","https://github.com/nodejs/undici/releases/tag/v7.30.1","https://github.com/nodejs/undici/releases/tag/v8.12.2"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-f72v-6w45-q472","url":"https://osv.dev/vulnerability/GHSA-f72v-6w45-q472"}],"summary":"undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens"}