{"id":"CVE-2026-85008","aliases":["GHSA-8436-99hf-9mmv"],"url":"https://o3.security/vulnerability/CVE-2026-85008","summary":"undici vulnerable to caching and replay of unsafe HTTP method responses","details":"### Impact\n\nundici's `interceptors.cache()` documents that it caches only safe HTTP methods. However, its internal skip-list is built by subtracting the configured methods from the safe-methods set, so an unsafe method (`POST`, `PUT`, `PATCH`, `DELETE`) never lands in the skip-list and is looked up against the cache store. Combined with the storage gate (`canCacheResponse`) having no method check, a heuristically-cacheable response (for example a `404`) with an explicit `Cache-Control: max-age=...` to an unsafe method is stored and replayed on a subsequent identical request. The application's state-changing request never reaches the origin, and undici serves a fabricated response from the cache instead. This occurs with the default configuration (`methods: ['GET']`), which the public API does not allow widening to unsafe methods, so no application misuse is required; an untrusted origin can trigger it purely through its own response headers.\n\n### Patches\n\nUpgrade to `7.29.1` or `8.10.2`. The cache interceptor no longer reads from or writes to the cache for unsafe HTTP methods, while still invalidating existing cache entries on successful unsafe requests.\n\n### Workarounds\n\nNone.","published":"2026-09-04T16:42:40.780Z","modified":"2026-10-21T02:31:04.869128100Z","cvss":{"score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"undici","fixedVersion":"7.29.1"},{"ecosystem":"npm","name":"undici","fixedVersion":"8.10.2"}],"fix":{"url":"https://github.com/nodejs/undici/commit/2be07bf97b3022e0324142d31f99f6e019d815e3","label":"nodejs/undici@2be07bf"},"references":[{"type":"ADVISORY","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85008.json"},{"type":"ADVISORY","url":"https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85008"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/2be07bf97b3022e0324142d31f99f6e019d815e3"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/b61d9432bac7caac51273ad209862e4c0bf935ae"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.10.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:31:04.869128100Z"}}