UBUNTU-CVE-2026-85152

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85008

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...

CVE-2026-80898

In the Linux kernel, the following vulnerability has been resolved: netfs: clear PGprivate2 on copy-to-cache append failure netfspgpriv2copytocache marks the folio with PGprivate2 before netfspgpriv2copyfolio appends it to the copy-to-cache rolling buffer. If the append fails, the folio is not...

CVE-2026-80898 netfs: clear PG_private_2 on copy-to-cache append failure

In the Linux kernel, the following vulnerability has been resolved: netfs: clear PGprivate2 on copy-to-cache append failure netfspgpriv2copytocache marks the folio with PGprivate2 before netfspgpriv2copyfolio appends it to the copy-to-cache rolling buffer. If the append fails, the folio is not...

CVE-2026-80898 netfs: clear PG_private_2 on copy-to-cache append failure

In the Linux kernel, the following vulnerability has been resolved: netfs: clear PGprivate2 on copy-to-cache append failure netfspgpriv2copytocache marks the folio with PGprivate2 before netfspgpriv2copyfolio appends it to the copy-to-cache rolling buffer. If the append fails, the folio is not...

CVE-2026-80898

CVE-2026-80898 affects the Linux kernel netfs subsystem. In netfs_pgpriv2_copy_to_cache(), a folio is marked with PG_private_2 before being appended to the copy-to-cache rolling buffer by netfs_pgpriv2_copy_folio(). If the append fails, the folio is not queued for cache writeback, yet the PG_priv...

EUVD-2026-71648

In the Linux kernel, the following vulnerability has been resolved: netfs: clear PGprivate2 on copy-to-cache append failure netfspgpriv2copytocache marks the folio with PGprivate2 before netfspgpriv2copyfolio appends it to the copy-to-cache rolling buffer. If the append fails, the folio is not...

Exploit for CVE-2026-11613

CVE-2026-11613 — Divi Ajax Filter RCE | | | |---|---| | Plug...

CVE-2026-85008 undici vulnerable to caching and replay of unsafe HTTP method responses

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...

CVE-2026-85008

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...

CVE-2026-85008 undici vulnerable to caching and replay of unsafe HTTP method responses

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...

CVE-2026-85008 undici vulnerable to caching and replay of unsafe HTTP method responses

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...

CVE-2026-85008

undici , a Node.js HTTP client library, contains an integrity flaw in its cache interceptor . The skip-caching logic subtracts configured methods from the set of safe methods, so unsafe methods such as POST , PUT , or DELETE are never excluded and fall through to the cache-read path. The response...

EUVD-2026-71489

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to th...

CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

EUVD-2026-71474

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-85152

undici (the Node.js HTTP client) versions 8.10.0 through 8.10.2 are vulnerable to cross-origin cache poisoning when the cache or deduplicate interceptor is composed directly onto a Client or Pool. The root cause is that the internal cache key falls back to an empty origin string, so a cacheable o...

CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...