Insufficient verification of data authenticity in undici - CVE-2026-85008
Published: September 6, 2026
Vulnerability identifier: #VU147175
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85008
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause unsafe HTTP requests to be served from the cache instead of reaching the origin.
The vulnerability exists due to insufficient verification of response authenticity in the undici cache interceptor when processing cacheable responses to unsafe HTTP methods. A remote attacker can return a heuristically cacheable response with an explicit Cache-Control max-age directive to an unsafe HTTP request to cause unsafe HTTP requests to be served from the cache instead of reaching the origin.
The issue occurs with the default methods: [\'GET\'] configuration.
Affected software
undici
How to mitigate CVE-2026-85008
Install security update from vendor's website.
undici - addressed in versions 7.29.1, 8.10.2