CVE-2026-85008 Overview
CVE-2026-85008 affects the undici HTTP client library for Node.js, specifically its cache interceptor component. The interceptor documents that only safe HTTP methods are cached. However, the skip-caching logic subtracts configured methods from the set of safe methods. Unsafe methods such as POST, PUT, and DELETE are never added to the skip list and fall through to the full cache-read path. The response-storage gate also lacks a method check, so cacheable responses to unsafe requests are stored and later replayed. The flaw is tracked under [CWE-345: Insufficient Verification of Data Authenticity].
Critical Impact
A malicious or compromised origin can respond once with a cacheable directive, causing subsequent state-changing client requests to that path to be served from the cache without reaching the origin.
Affected Products
- undici versions 7.0.0 through 7.29.0
- undici versions 8.0.0 through 8.10.1
- Node.js applications using the undici cache interceptor under default configuration
Discovery Timeline
- 2026-09-04 - CVE-2026-85008 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-85008
Vulnerability Analysis
The undici cache interceptor implements HTTP caching semantics for outbound requests. Its design intent is to cache only safe HTTP methods such as GET and HEAD. The implementation derives the skip-cache list by subtracting user-configured methods from the safe-methods set. This logic inverts the intended behavior. Unsafe methods, which are never members of the safe-methods set, cannot appear in the resulting skip list. The interceptor therefore processes POST, PUT, and DELETE requests through the cache-read path.
Compounding the read-side flaw, the response-storage gate omits a method validation check. Responses that are heuristically cacheable or that carry an explicit Cache-Control directive are stored regardless of the originating request method. Because response headers from a remote origin are untrusted, an origin that returns a single cacheable response can poison the local cache for a given path.
Root Cause
The root cause is inverted set logic in the method-filtering routine combined with a missing method check on the storage path. Both gates were designed around the assumption that only safe methods reach the caching layer, but neither gate enforces that assumption at runtime.
Attack Vector
An attacker who controls or compromises an origin server responds to an initial request with a cacheable status code or a permissive Cache-Control header. The undici client stores the response. Subsequent state-changing requests from the client to the same path are served from cache. The origin never observes the follow-up requests, breaking write integrity for the affected path. Exploitation requires the target application to use the cache interceptor with default configuration and to send unsafe requests to an attacker-influenced origin.
No verified proof-of-concept code is published. Refer to the GitHub Security Advisory GHSA-8436 for maintainer technical detail.
Detection Methods for CVE-2026-85008
Indicators of Compromise
- Application logs showing successful POST, PUT, or DELETE responses returned without a corresponding outbound network flow to the origin
- Repeated identical responses to state-changing requests within the cache TTL window
- Origin-side access logs missing expected write requests that the client believes it sent
Detection Strategies
- Inventory Node.js services and identify those depending on undici versions 7.0.0–7.29.0 or 8.0.0–8.10.1 using the cache interceptor
- Correlate outbound HTTP telemetry with application-level request logs to identify mismatches between issued requests and origin-observed traffic
- Review dependency manifests (package.json, package-lock.json, yarn.lock) for direct or transitive use of vulnerable undici releases
Monitoring Recommendations
- Instrument the undici interceptor chain to log method, URL, and cache-hit status for every dispatched request
- Alert on cache hits for HTTP methods other than GET and HEAD
- Track upstream request counts per path and compare against downstream client request counts to detect suppressed writes
How to Mitigate CVE-2026-85008
Immediate Actions Required
- Upgrade undici to version 7.29.1 or 8.10.2
- Audit application code that constructs the cache interceptor to confirm the fixed version is loaded at runtime
- Review recent responses served from cache for state-changing endpoints and reconcile with origin state where integrity matters
Patch Information
The maintainers released fixed builds in undici7.29.1 and 8.10.2. Both releases add a method check to the response-storage gate and correct the skip-list construction so unsafe methods bypass the cache. See the OpenJSF Security Advisories and GitHub Security Advisory GHSA-8436 for the full changelog.
Workarounds
- Disable the cache interceptor entirely until the patched version is deployed
- Restrict the cache interceptor to explicitly enumerated safe methods and validate the configuration path at startup
- Route state-changing traffic through a separate undici dispatcher instance that does not attach the cache interceptor
# Configuration example
npm install undici@^8.10.2
# or for the 7.x line
npm install undici@^7.29.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
