Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-85008— undici vulnerable to caching and replay of unsafe HTTP method responses

Quick assessment

Affected
undici undici
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

undici 的缓存拦截器文档声称只有“安全”的 HTTP 方法会被缓存，但其跳过缓存的逻辑是通过从安全方法集合中减去配置的方法来构建的，导致诸如 POST、PUT 或 DELETE 等“非安全”方法永远不会被列入跳过缓存列表，而是直接落入完整的缓存读取路径。此外，响应存储的门槛也缺乏方法检查，因此针对非安全请求的响应如果被认为是可启发式缓存的，或携带了显式的 指令，也会被存入缓存，并在后续从缓存中重放。由于来自远程源站的响应头是不可信的，源站可以首次返回一个可缓存的状态码，随后客户端对该路径发起的后续会改变状态（

CVSS 3.7 · Low

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle

Affected Version Matrix 4

VendorProduct Version RangeStatus
undici undici 7.0.0< 7.29.1 affected
7.29.1 unaffected
8.0.0< 8.10.2 affected
8.10.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85008

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
undici vulnerable to caching and replay of unsafe HTTP method responses
Source: CVE Program / CVE List V5
Vulnerability Description
undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also lacked a method check, so a response to an unsafe request that is heuristically cacheable or carries an explicit Cache-Control directive is stored and later replayed from cache. Because response headers from a remote origin are untrusted, an origin can answer once with a cacheable status and then have the client's own subsequent state-changing requests to that path served from the stale cache entry without ever reaching the origin, an integrity failure that occurs under the interceptor's default configuration. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
undici undici 7.0.0 ~ 7.29.1 -

II. Public POCs for CVE-2026-85008

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85008

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-85008 (1)

Same Patch Batch · undici · 2026-09-04 · 11 CVEs total

CVE-2026-19534 7.5 HIGH undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
CVE-2026-85152 7.4 HIGH undici vulnerable to cross-origin cache poisoning via missing origin isolation in intercep
CVE-2026-84961 7.4 HIGH undici vulnerable to TLS certificate validation bypass via dropped connect options in Bala
CVE-2026-84933 6.5 MEDIUM undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
CVE-2026-85024 5.9 MEDIUM undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate
CVE-2026-85014 5.9 MEDIUM undici vulnerable to Denial of Service via WebSocketStream unclean close
CVE-2026-18149 5.9 MEDIUM undici vulnerable to Denial of Service via orphaned RetryHandler response body
CVE-2026-84890 5.9 MEDIUM undici vulnerable to Denial of Service via unbounded decompression of compressed responses
CVE-2026-84947 3.7 LOW undici vulnerable to response truncation via oversized chunked responses in the dump inter
CVE-2026-18540 3.7 LOW undici vulnerable to downstream response splitting via retry interceptor

IV. Related Vulnerabilities

Same product: undici
Same vendor: undici
Same weakness: CWE-345

V. Comments for CVE-2026-85008

No comments yet

Leave a comment