undici’s fetch implementation incorrectly treats Subresource Integrity (SRI) algorithm tokens that contain uppercase or mixed‑case characters as unknown. When all tokens in the integrity list are ignored, the library accepts the response as possessing no integrity constraints. An attacker with control of the HTTP response body can thus deliver arbitrary content to an application that relies on a non‑lowercase SRI token, compromising the integrity of that payload.

The issue affects the undici HTTP client library for Node.js. Vulnerable versions are 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1. The fix is included in undici 7.30.1 and 8.12.2, which normalize algorithm tokens to ASCII lowercase before validation.

The CVSS score of 5.9 indicates a moderate risk level. EPSS data is reported as < 1%, suggesting a very low but non‑zero probability of exploitation and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to control the server that serves the challenged resource; once the server is compromised or the attacker can modify the response, the victim’s application will silently accept the malicious payload.