CVE-2026-85008 undici CVE debrief

Who should care

Defenders responsible for Node.js applications using undici should assess exposure and prioritize upgrading to undici 7.29.1 or 8.10.2. This includes operators, platform administrators, vulnerability management teams, and security teams who manage or use undici in their applications. They should review the vulnerability details, assess the impact on their systems, and plan for the necessary upgrades or mitigations. Additionally, they should monitor for any

Why it matters

CVE-2026-85008 is a vulnerability in undici that allows an origin to serve stale cache entries to a client's state-changing requests, leading to potential integrity failures. Defenders responsible for Node.js applications using undici should assess exposure and prioritize upgrading to undici 7.29.1 or 8.10.2.

• Potential integrity failures due to stale cache entries
• Possible unauthorized data access or modification
• Required verification of affected systems and upgrade to patched versions
• Need for monitoring and incident response planning

Technical summary

The vulnerability is caused by a flaw in undici's cache interceptor logic, which allows an origin to serve stale cache entries to a client's state-changing requests. The vulnerability affects undici versions from 7.0.0 to 7.29.1 and from 8.0.0 to 8.10.2. This flaw results in an integrity failure as responses to unsafe requests can be stored and replayed from cache without reaching the origin. Users should upgrade to undici 7.29.1 or 8.10.2 to prevent potential integrity failures. The cache interceptor's logic to skip caching is built by subtracting the configured methods from the set of safe methods, leading to unsafe methods being cached.

Defensive priority

Defenders should prioritize upgrading to undici 7.29.1 or 8.10.2 to prevent potential integrity failures.

Recommended defensive actions

• Upgrade to undici 7.29.1 or 8.10.2
• Review and update affected systems
• Monitor for potential integrity failures
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by a flaw in undici's cache interceptor logic, which allows an origin to serve stale cache entries to a client's state-changing requests. The vulnerability affects undici versions from 7.0.0 to 7.29.1 and from 8.0.0 to 8.10.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.