{"id":"CVE-2024-30261","aliases":["GHSA-9qxr-qj54-h672"],"url":"https://o3.security/vulnerability/CVE-2024-30261","summary":"Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect","details":"### Impact\n\nIf an attacker can alter the `integrity` option passed to `fetch()`, they can let `fetch()` accept requests as valid even if they have been tampered.\n\n### Patches\n\nFixed in https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3.\nFixes has been released in v5.28.4 and v6.11.1.\n\n\n### Workarounds\n\nEnsure that `integrity` cannot be tampered with.\n\n### References\n\nhttps://hackerone.com/reports/2377760","published":"2024-04-04T15:09:11.369Z","modified":"2026-08-12T03:51:43.314208706Z","cvss":{"score":2.6,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"undici","fixedVersion":"5.28.4"},{"ecosystem":"npm","name":"undici","fixedVersion":"6.11.1"}],"fix":{"url":"https://github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055","label":"nodejs/undici@2b39440"},"references":[{"type":"WEB","url":"https://hackerone.com/reports/2377760"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30261.json"},{"type":"ADVISORY","url":"https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30261"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20240905-0008/"},{"type":"FIX","url":"https://github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055"},{"type":"FIX","url":"https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240905-0008"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:43.314208706Z"}}