CVE-2026-85008

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1

Description The cache interceptor incorrectly handles the caching of unsafe HTTP methods. While documentation states only safe methods are cached, the logic used to skip caching fails to include unsafe methods like POST, PUT, or DELETE in the skip list. Consequently, these requests enter the cache-read path. Additionally, the response-storage gate does not verify the HTTP method, allowing responses to unsafe requests that are heuristically cacheable or contain a Cache-Control directive to be stored. This allows a remote origin to provide a cacheable response that the client will later replay for subsequent state-changing requests, preventing them from reaching the origin and causing an integrity failure.

Recommendations Upgrade to version 7.29.1 for installations using the 7.x branch. Upgrade to version 8.10.2 for installations using the 8.x branch.