CVE-2026-85008: undici Vulnerable to Caching and Replay of Unsafe HTTP Method Responses
Summary
CVE-2026-85008: undici vulnerable to caching and replay of unsafe HTTP method responses. Affects undici across 2 version ranges.
>= 7.0.0, < 7.29.1
>= 8.0.0, < 8.10.2
Fixed in 7.29.1 or 8.10.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
undici is a high-performance HTTP/1.1 client designed for Node.js, known for its speed and efficiency in handling HTTP requests. It provides features such as connection pooling, request interception, and caching. However, it has a vulnerability that affects how it caches responses from unsafe HTTP methods, potentially leading to unintended behavior in applications.
Vulnerability Detail
The vulnerability arises from undici's caching mechanism, which is intended to cache only safe HTTP methods (GET). However, due to a flaw in its internal logic, unsafe methods (POST, PUT, PATCH, DELETE) can still be cached. This occurs because the method check is not properly enforced, allowing responses from unsafe methods to be stored and replayed. As a result, a state-changing request may be intercepted, and a fabricated response could be served from the cache instead of reaching the origin server. This can lead to significant security risks, especially when untrusted origins are involved.
How To Fix
Latest published version: 8.12.3 as of 22 Oct 2026
npm install undici@8.12.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.29.17.29.1npm install undici@7.29.1 -
>= 8.0.0, < 8.10.28.10.2npm install undici@8.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. The best course of action is to upgrade to the patched versions of undici.
Conclusion
The vulnerability CVE-2026-85008 in the undici package poses a significant risk by allowing unsafe HTTP method responses to be cached and replayed. It is crucial for users of undici to upgrade to the patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for undici →
FAQ
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
Versions of undici starting from 7.0.0 up to 7.29.0 and from 8.0.0 up to 8.10.1 are affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
Unsafe HTTP methods include POST, PUT, PATCH, and DELETE. These methods can change the state of the server and should be handled with caution.
Yes, if you do not update undici, your application may be vulnerable to caching and replay attacks, which could lead to unauthorized actions being performed on your server.
References
Related vulnerabilities
Recent vulnerabilities recorded for undici.
