Node undici: undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured… (CVE-2026-85008)
Description
The Node.js HTTP client library undici has a cache interceptor vulnerability where unsafe HTTP methods such as POST, PUT, PATCH, and DELETE are improperly cached due to a logic flaw. This can cause state-changing requests to be bypassed by serving cached responses, potentially leading to inconsistent application state. The issue affects undici versions from 7.0.0 up to but not including 7.29.1 and from 8.0.0 up to but not including 8.10.2. Fixed versions 7.29.1 and 8.10.2 prevent caching unsafe method responses while still invalidating cache entries on successful unsafe requests. No workarounds are provided.
CVSS v3.1
Score 5.3medium
Affected software
pkg:deb/ubuntu/node-undici?arch=source&distro=noblepkg:deb/ubuntu/node-undici?arch=source&distro=resolutepkg:deb/ubuntu/node-undici?arch=source&distro=stonkingRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
undici's cache interceptor incorrectly caches responses to unsafe HTTP methods (POST, PUT, PATCH, DELETE) due to flawed logic in its skip-list and cache storage checks. This flaw allows cached responses to be served for state-changing requests, potentially causing inconsistent application state. The vulnerability affects versions >=7.0.0 <7.29.1 and >=8.0.0 <8.10.2. Fixed in versions 7.29.1 and 8.10.2, the fix ensures unsafe method responses are not cached but still invalidates cache entries on successful unsafe requests.
Potential Impact
The vulnerability can lead to inconsistent application state by serving cached responses for unsafe HTTP methods that are expected to change state. This undermines the correctness of state-changing operations, potentially causing application logic errors or stale data usage. There is no direct confidentiality or availability impact reported.
Mitigation Recommendations
A fix is available in undici versions 7.29.1 and 8.10.2 that correctly prevents caching of unsafe HTTP method responses while still invalidating cache entries on successful unsafe requests. Users should upgrade to these fixed versions. No workarounds are provided.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-85008
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6a9ee1aeacd9273b49e69c08
Added to database: 09/07/2026, 16:09:18 UTC
Last enriched: 10/18/2026, 02:25:11 UTC
Last updated: 10/22/2026, 13:15:24 UTC
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.