| Package | Affected versions | Patched versions |
|---|---|---|
| undici | ≥ 6.0.0, < 6.11.1< 5.28.4 | 6.11.15.28.4 |
| undici | ≥ 6.0.0, < 6.11.1< 5.28.4 | 6.11.15.28.4 |
If an attacker can alter the integrity option passed to fetch(), they can let fetch() accept requests as valid even if they have been tampered.
Fixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3. Fixes has been released in v5.28.4 and v6.11.1.
Ensure that integrity cannot be tampered with.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free