Undici performs Subresource Integrity checks by splitting the integrity header on a single space, but the SRI spec allows any ASCII whitespace, such as a horizontal tab, as a separator. An integrity value prefixed with such whitespace is parsed as an unrecognized token and discarded. When no valid algorithm remains, Undici treats the list as empty and accepts the response, enabling a server that returns a mismatched body to pass the check. As a result, an application that pins a resource using an integrity value surrounded by whitespace can receive attacker‑controlled bytes without triggering an integrity error, removing the guarantee that the response content matches the expected digest and enabling arbitrary code or data injection.

Undici, the HTTP client library for Node.js, is affected in versions 7.15.0 through 7.30.1 and 8.0.0 through 8.12.3. The issue was fixed in Undici 7.30.2 and 8.12.4, and later releases are not affected.

The CVSS score of 5.9 places this vulnerability in the medium severity range. Because no EPSS value is supplied, the likelihood of exploitation in the wild is unclear, and the vulnerability is not currently cataloged in CISA’s Known Exploited Vulnerabilities list. An attacker would need to control a server that provides a response to a fetch request performed by Undici in a Node.js application. Based on the description, it is inferred that the attack requires only the ability to influence the HTTP response body and manipulate the integrity header to include whitespace around the digest; this allows the attacker to bypass SRI verification and inject malicious content into the client.