PatchTheCVECVE-2026-85008: undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is
CVE-2026-85008 is a low-severity flaw (CVSS 3.7) affecting undici. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also lacked a method check, so a response to an unsafe request that is heuristically cacheable or carri
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.7 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 98%) |
| CISA exploited list | No |
| Weakness | CWE-345 |
| Published | 2026-09-04 |
| Last modified | 2026-09-15 |
Last updated 2026-09-15 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-85008?
undici: upgrade to 7.29.1, 8.10.2. Exact commands for each OS are on this page.
Is CVE-2026-85008 being exploited?
CVE-2026-85008 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-85008 affect?
CVE-2026-85008 affects undici. Severity is low (CVSS 3.7). undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is neve
How urgent is CVE-2026-85008?
Priority 18/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-109855 HIGH 7.5 UPGRADE undici is an HTTP client library for Node.js
- CVE-2026-109383 HIGH 7.4 UPGRADE undici is an HTTP client library for Node.js
- CVE-2026-109829 HIGH 7.4 UPGRADE undici is an HTTP client library for Node.js
- CVE-2026-109841 MEDIUM 5.9 UPGRADE undici is an HTTP client library for Node.js
- CVE-2026-109869 HIGH 7.5 UPGRADE undici is an HTTP client library for Node.js