undici vulnerable to caching and replay of unsafe HTTP method responses

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-85008 · Microsoft / collected KEV context

EUVD-2026-71489

GHSA-8436-99hf-9mmv

cve-program · CVE-2026-85008

• https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-71489

• https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-85008

• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv

osv · GHSA-8436-99hf-9mmv

• https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv
• https://nvd.nist.gov/vuln/detail/CVE-2026-85008
• https://github.com/nodejs/undici/commit/2be07bf97b3022e0324142d31f99f6e019d815e3
• https://github.com/nodejs/undici/commit/b61d9432bac7caac51273ad209862e4c0bf935ae
• https://cna.openjsf.org/security-advisories.html
• https://github.com/nodejs/undici
• https://github.com/nodejs/undici/releases/tag/v7.29.1
• https://github.com/nodejs/undici/releases/tag/v8.10.2

• undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is neve… · Advisory content revised · 5 Nov 2026