Disclosure summary
### Impact undici's `interceptors.cache()` documents that it caches only safe HTTP methods. However, its internal skip-list is built by subtracting the configured methods from the safe-methods set, so an unsafe method (`POST`, `PUT`, `PATCH`, `DELETE`) never lands in the skip-list and is looked up against the cache store. Combined with the storage gate (`canCacheResponse`) having no method check, a heuristically-cacheable response (for example a `404`) with an explicit `Cache-Control: max-age=...` to an unsafe method is stored and replayed on a subsequent identical request. The application's state-changing request never reaches the origin, and undici serves a fabricated response from the cache instead. This occurs with the default configuration (`methods: ['GET']`), which the public API does not allow widening to unsafe methods, so no application misuse is required; an untrusted origin can trigger it purely through its own response headers. ### Patches Upgrade to `7.29.1` or `8.10.2`. The cache interceptor no longer reads from or writes to the cache for unsafe HTTP methods, while still invalidating existing cache entries on successful unsafe requests. ### Workarounds None.
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-8436-99hf-9mmv
Open original source · Updated Sep 29, 2026
undici vulnerable to caching and replay of unsafe HTTP method responses
Source severity: LOW / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | undici | >= 7.0.0, < 7.29.1 | 7.29.1 |
| npm | undici | >= 8.0.0, < 8.10.2 | 8.10.2 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-09-29T14:16:28-04:00
MODIFIED 2026-09-29T14:16:29-04:00
INGESTED 2026-10-06T11:43:08-04:00