{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"node-undici","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NVZ1NWNVMHNBJVTCEB4DDS","modified_at":"2026-10-01T03:03:43.141080466Z","published_at":"2026-09-04T17:17:02.347Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-85008","https://security-tracker.debian.org/tracker/CVE-2026-85008"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-85008#Debian:13/node-undici","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-85008"}],"summary":"undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe met"}