Search: CVE-2026-85152

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	7.4	EPSS 0.2%	CVE-2026-85152Node undici · undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed High7.4EPSS 0.2%2026-09-04GCVE DatabaseCVE-2026-85152 A vulnerability in the undici HTTP client library versions 8.10.0 and 8.10.1 allows cross-origin cache poisoning due to missing origin isolation in cache and deduplication interceptors. This flaw causes cache keys to omit the destination origin, enabling an attacker controlling one origin's response to poison the cache for another trusted origin. The issue does not affect the default Agent-based dispatch path. A patch is available in version 8.10.2. EPSS 0.2%Vulnerability CWE-346 #ghsa-vp8m-p9jh-q5pm #npm	GCVE Database	2026-09-04

Page 1 of 1