Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect

低 3.5CVE-2024-30261 · GHSA-9qxr-qj54-h672 · 04/04/2024 公開 · 17/06/2026 更新

要点

CVE-2024-30261 は undici (nodejs), undici に影響する深刻度「低」 (CVSS 3.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.80%（全脆弱性の 56.7% より高い）。
対処：6.11.1, 5.28.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
undici nodejs	`≥ 6.0.0, < 6.11.1< 5.28.4`	`6.11.15.28.4`
undici npm	`≥ 6.0.0, < 6.11.1< 5.28.4`	`6.11.15.28.4`

概要

Impact

If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.

Patches

Fixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3. Fixes has been released in v5.28.4 and v6.11.1.

Workarounds

Ensure that integrity cannot be tampered with.

References

https://hackerone.com/reports/2377760

NVD の説明

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.