CVE-2026-85008

A flaw was found in undici. The cache interceptor incorrectly caches responses to unsafe HTTP methods, such as POST, PUT, or DELETE. A remote attacker can exploit this by providing a cacheable response, leading to subsequent state-changing requests being served from a stale cache entry without reaching the origin. This can result in an integrity failure, where the client's application state is not updated as expected.

This Low impact vulnerability in undici's cache interceptor can lead to integrity issues by caching responses for unsafe HTTP methods. Under certain default configurations, a malicious remote origin could cause stale or manipulated responses to be served from the cache, bypassing intended state changes. This risk is considered low due to the specific conditions required for exploitation and the limited scope of impact on data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.