The flaw in undici’s cache interceptor allows unsafe HTTP methods such as POST, PUT, or DELETE to be cached because the logic that skips caching mistakenly excludes these methods from the skip list. A response to an unsafe request that is either heuristically cacheable or carries a Cache‑Control directive is then stored and can be replayed for subsequent identical requests. Since response headers from the origin are untrusted, an attacker can orchestrate a scenario where a client’s state‑changing request receives a stale, cached response instead of reaching the original server, thereby preventing the intended state change and breaching data integrity. This has the character of an integrity failure driven by improper cache validation (CWE‑345) and improper caching of unsafe HTTP methods (CWE‑444).

All Node.js applications that use the undici HTTP client library versions 7.0.0 through 7.29.1 and 8.0.0 through 8.10.2 are affected. The vulnerability exists in the undici:undici product as maintained by the Node.js Foundation.

The vulnerability carries a CVSS score of 3.7, indicating a low severity classification. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog, suggesting limited known exploitation. The likelihood of exploitation is inferred to be low because an attacker would need to induce the client to make a cacheable unsafe request and rely on an intermediary that respects undici’s caching policy. Nevertheless, the integrity impact, as described by CWE‑345 and CWE‑444, warrants prompt action. No requirement for privileged access or remote code execution is necessary; the exploit relies on normal client traffic and cache behavior.