CVE-2026-85152 Nodejs CVE debrief

Who should care

Defenders of applications using undici should assess exposure, especially those with untrusted origins. Node.js developers and security teams should prioritize upgrading to undici 8.10.2.

Why it matters

CVE-2026-85152 is a high-severity vulnerability in undici that allows cross-origin information disclosure and persistent cache poisoning. Defenders should assess exposure, prioritize upgrading to undici 8.10.2, and verify cache configurations.

• Cross-origin information disclosure
• Persistent cache poisoning through cache-deduplication weaknesses
• Potential for authentication bypass in certain configurations
• Verification of cache and request-deduplication configurations required

Technical summary

The vulnerability is caused by undici 8.10.0 omitting the destination origin from cache and request-deduplication keys when composed directly onto a Client or Pool. This allows a cacheable or in-flight response from one upstream origin to be returned for a request to a different, trusted origin when method, path, and relevant headers match. The issue affects undici versions from 8.10.0 to 8.10.2 and can be mitigated by upgrading to undici 8.10.2. A reporter demonstrated a full authentication bypass. Applications using an Agent are not affected as it carries the origin in its dispatch options.

Defensive priority

Upgrade to undici 8.10.2 to mitigate the vulnerability. Review applications using undici for exposure, especially those with untrusted origins. Verify cache and request-deduplication configurations.

Recommended defensive actions

• Upgrade to undici 8.10.2
• Review applications using undici for exposure
• Verify cache and request-deduplication configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was introduced in undici 8.10.0 and affects versions up to 8.10.2. A reporter demonstrated a full authentication bypass. The issue is a regression and can be mitigated by upgrading to undici 8.10.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.