EUVD-2026-71489Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AV:N because the malicious origin is remote; AC:H because exploitation requires the attacker to control the origin and issue specific cache headers; I:L because impact is limited to stale replay with no confidentiality loss.
Primary rating from Vendor (openjs).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also lacked a method check, so a response to an unsafe request that is heuristically cacheable or carries an explicit Cache-Control directive is stored and later replayed from cache. Because response headers from a remote origin are untrusted, an origin can answer once with a cacheable status and then have the client's own subsequent state-changing requests to that path served from the stale cache entry without ever reaching the origin, an integrity failure that occurs under the interceptor's default configuration. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
AnalysisAI
undici's cache interceptor incorrectly permits responses to unsafe HTTP methods - POST, PUT, DELETE, and PATCH - to be stored and later replayed, because the skip-list that gates caching is built by subtracting configured methods from the safe-method set rather than by positively excluding all non-safe methods, leaving unsafe methods unguarded. A remote origin that returns a heuristically cacheable status code or an explicit Cache-Control directive in response to a state-changing request causes undici to store that response; all subsequent client requests to the same path using the same method are then served from the stale cache entry without ever reaching the origin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions are required for exploitation: (1) the application explicitly attaches undici's cache interceptor - it is opt-in and not active in undici's default configuration, so applications that have not configured it are fully unaffected; (2) the application sends at least one unsafe HTTP method (POST, PUT, DELETE, or PATCH) to an origin the attacker controls or has compromised; and (3) the attacker's origin returns a response carrying an explicit Cache-Control caching directive (e.g., max-age, s-maxage) or a heuristically cacheable HTTP status code. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately captures the constrained exploitation surface: the attacker must control or compromise the target HTTP origin and craft responses with explicit caching directives, which elevates attack complexity to AC:H and makes mass exploitation implausible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to undici 7.29.1 on the 7.x branch or undici 8.10.2 on the 8.x branch, as confirmed by the OpenJS Foundation advisory at https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forge
Memory exhaustion denial of service in the undici WebSocket client (versions 6.17.0 and later) allows a malicious or com
Cross-user information disclosure in undici's cache interceptor allows authenticated users' responses to be served from
Cookie attribute injection in undici's setCookie function allows attacker-controlled domain values or unparsed array ent
Authorization headers are cleared on cross-origin redirect. Rated medium severity (CVSS 6.5), this vulnerability is remo
`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to th
CRLF injection in undici's HTTP/1.1 dispatcher enables HTTP header injection and potential request smuggling when applic
Undici is an HTTP/1.1 client for Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable,
undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection
Cross-user information disclosure and a parse-time denial of service in undici's HTTP cache interceptor affect versions
TLS certificate validation bypass in undici's BalancedPool dispatcher silently discards function-valued options - includ
Cross-origin request misrouting in undici's Socks5ProxyAgent (introduced in 7.23.0, affecting all releases through 8.1.0
Share
External POC / Exploit Code
Leaving vuln.today