Sign in
Deutsch English Español Polski
Low

undici vulnerable to caching and replay of unsafe HTTP method responses

  • Disclosed: 29.09.2026
  • Updated: 11.10.2026 10:22

Impact

undici's interceptors.cache() documents that it caches only safe HTTP methods. However, its internal skip-list is built by subtracting the configured methods from the safe-methods set, so an unsafe method (POST, PUT, PATCH, DELETE) never lands in the skip-list and is looked up against the cache store. Combined with the storage gate (canCacheResponse) having no method check, a heuristically-cacheable response (for example a 404) with an explicit Cache-Control: max-age=... to an unsafe method is stored and replayed on a subsequent identical request. The application's state-changing request never reaches the origin, and undici serves a fabricated response from the cache instead. This occurs with the default configuration (methods: ['GET']), which the public API does not allow widening to unsafe methods, so no application misuse is required; an untrusted origin can trigger it purely through its own response headers.

Patches

Upgrade to 7.29.1 or 8.10.2. The cache interceptor no longer reads from or writes to the cache for unsafe HTTP methods, while still invalidating existing cache entries on successful unsafe requests.

Workarounds

None.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package undici >= 7.0.0, < 7.29.1, >= 8.0.0, < 8.10.2 7.29.1, 8.10.2

References

CVSS score 3.7/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness (CWE)
CWE-345
Platform
npm
Package
undici
Disclosed
29.09.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-8436-99hf-9mmv - CC BY 4.0

Vulnerability history: undici

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (46) in the archive
Total entries
46
First → latest
06.2022 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 13
  • Medium 21
  • Low 12

Disclosures per year

Severity:
  1. undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
    High · 7.5 CVE-2026-19534 >= 6.7.0, < 6.28.1, >= 7.0.0, < 7.29.1, >= 8.0.0, < 8.10.2 6.28.1, 7.29.1, 8.10.2
  2. undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
    High · 7.4 CVE-2026-84961 >= 7.24.1, < 7.29.1, >= 8.0.0, < 8.10.2 7.29.1, 8.10.2
  3. undici vulnerable to caching and replay of unsafe HTTP method responses this entry
    Low · 3.7 CVE-2026-85008 >= 7.0.0, < 7.29.1, >= 8.0.0, < 8.10.2 7.29.1, 8.10.2
  4. undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
    High · 7.4 CVE-2026-85152 >= 8.10.0, < 8.10.2 8.10.2
  5. undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
    High · 7.4 CVE-2026-13697 >= 7.0.0, < 7.29.0, >= 8.0.0, < 8.9.0 7.29.0, 8.9.0
  6. undici WebSocket client vulnerable to denial of service via fragment count bypass
    High · 7.5 CVE-2026-12151 < 6.27.0, >= 7.0.0, < 7.28.0, >= 8.0.0, < 8.5.0 6.27.0, 7.28.0, 8.5.0
  7. undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
    High · 7.5 CVE-2026-6734 >= 7.23.0, < 7.28.0, >= 8.0.0, < 8.2.0 7.28.0, 8.2.0
  8. undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
    High · 7.4 CVE-2026-9697 >= 7.23.0, < 7.28.0, >= 8.0.0, < 8.5.0 7.28.0, 8.5.0
  9. undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
    High · 7.5 CVE-2026-9675 >= 8.0.0, < 8.5.0 8.5.0
  10. Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
    High · 7.5 CVE-2026-1526 < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0
  11. Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
    High · 7.5 CVE-2026-2229 < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0
  12. Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
    High · 7.5 CVE-2026-1528 >= 6.0.0, < 6.24.0, >= 7.0.0, < 7.24.0 6.24.0, 7.24.0
  13. Regular Expression Denial of Service in Headers
    High · 7.5 CVE-2023-24807 < 5.19.1 5.19.1
  14. ProxyAgent vulnerable to MITM
    High · 7.7 CVE-2022-32210 >= 4.8.2, < 5.5.1 5.5.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.