undici CVE-2026-85008

Three concurrent conditions are required for exploitation: (1) the application explicitly attaches undici's cache interceptor - it is opt-in and not active in undici's default configuration, so applications that have not configured it are fully unaffected; (2) the application sends at least one unsafe HTTP method (POST, PUT, DELETE, or PATCH) to an origin the attacker controls or has compromised; and (3) the attacker's origin returns a response carrying an explicit Cache-Control caching directive (e.g., max-age, s-maxage) or a heuristically cacheable HTTP status code. Applications communicating exclusively with internally controlled, trusted origins are not at realistic risk even with the interceptor active. Client-side authentication state is irrelevant to exploitability; the vulnerability operates at the HTTP cache layer below any application-level auth.

CVSS 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately captures the constrained exploitation surface: the attacker must control or compromise the target HTTP origin and craft responses with explicit caching directives, which elevates attack complexity to AC:H and makes mass exploitation implausible. No CISA KEV listing, no public proof-of-concept code, and no EPSS data appear in the available intelligence, so no public exploit has been identified at time of analysis. Practically, even a mid-sized municipal IT team in gliwice managing internal microservices should treat this as a low-urgency but non-trivial upgrade for any service that enables undici's cache interceptor against untrusted upstream origins, since an integrity failure that silently swallows state mutations can cause subtle application-level data corruption that is difficult to detect without explicit cache-layer logging. The real-world footprint is moderated by the fact that the cache interceptor is opt-in, not enabled in undici's baseline configuration - applications that have not explicitly attached the interceptor are entirely unaffected regardless of version. Where the interceptor is active, the CVSS integrity score of I:L may understate operational impact: missed POST/PUT/DELETE calls can cascade into corrupted business state, failed authentication flows, or suppressed audit events, even though no direct data exfiltration occurs.

An attacker controlling a third-party API endpoint responds to a Node.js client's POST /transfer request with HTTP 200 and Cache-Control: max-age=3600; undici's cache interceptor stores the response because the method check is absent. All subsequent POST /transfer requests from that client are silently served from the cached entry, meaning no actual transfer ever reaches the origin after the first call - the client application receives a success response each time while the origin processes nothing. No public proof-of-concept code exists at time of analysis, and this attack requires the attacker to own or compromise the target origin server.