Cache Interceptor Vulnerability in Undici Affecting Node.js Applications

CVE-2026-85008

What is CVE-2026-85008?

The cache interceptor in the Undici HTTP client by Node.js allows unsafe HTTP methods such as POST, PUT, or DELETE to be inadvertently cached due to a flaw in its logic. This misconfiguration can result in responses to state-changing requests being served from the cache rather than being directed to the origin server. Consequently, this can lead to stale entries being utilized, allowing malicious actors to exploit the situation by providing a cacheable response for a subsequent unsafe request. It is essential for users utilizing Undici versions from 7.0.0 to 7.29.1 and 8.0.0 to 8.10.2 to upgrade to the patched versions 7.29.1 or 8.10.2 to mitigate these risks.

References