undici up to 7.29.0/8.10.1 Cache Interceptor input validation

Summaryinfo

A vulnerability classified as problematic was found in undici up to 7.29.0/8.10.1. This vulnerability affects unknown code of the component Cache Interceptor. Executing a manipulation can lead to input validation. This vulnerability appears as CVE-2026-85008. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in undici up to 7.29.0/8.10.1 and classified as problematic. This vulnerability affects an unknown function of the component Cache Interceptor. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect integrity. CVE summarizes:

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also lacked a method check, so a response to an unsafe request that is heuristically cacheable or carries an explicit Cache-Control directive is stored and later replayed from cache. Because response headers from a remote origin are untrusted, an origin can answer once with a cacheable status and then have the client's own subsequent state-changing requests to that path served from the stale cache entry without ever reaching the origin, an integrity failure that occurs under the interceptor's default configuration. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-85008 since 09/02/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 343106 (Linux Distros Unpatched Vulnerability : CVE-2026-85008), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 7.29.1 or 8.10.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (343106). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• undici

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8
• 7.9
• 7.10
• 7.11
• 7.12
• 7.13
• 7.14
• 7.15
• 7.16
• 7.17
• 7.18
• 7.19
• 7.20
• 7.21
• 7.22
• 7.23
• 7.24
• 7.25
• 7.26
• 7.27
• 7.28
• 7.29.0
• 8.10.0
• 8.10.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion