CVE-2026-85008

Impact

undici's interceptors.cache() documents that it caches only safe HTTP methods. However, its internal skip-list is built by subtracting the configured methods from the safe-methods set, so an unsafe method (POST, PUT, PATCH, DELETE) never lands in the skip-list and is looked up against the cache store. Combined with the storage gate (canCacheResponse) having no method check, a heuristically-cacheable response (for example a 404) with an explicit Cache-Control: max-age=... to an unsafe method is stored and replayed on a subsequent identical request. The application's state-changing request never reaches the origin, and undici serves a fabricated response from the cache instead. This occurs with the default configuration (methods: ['GET']), which the public API does not allow widening to unsafe methods, so no application misuse is required; an untrusted origin can trigger it purely through its own response headers.

Patches

Upgrade to 7.29.1 or 8.10.2. The cache interceptor no longer reads from or writes to the cache for unsafe HTTP methods, while still invalidating existing cache entries on successful unsafe requests.

Workarounds

None.

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the skip list and instead falls through to the full cache-read path. The response-storage gate also lacked a method check, so a response to an unsafe request that is heuristically cacheable or carries an explicit Cache-Control directive is stored and later replayed from cache. Because response headers from a remote origin are untrusted, an origin can answer once with a cacheable status and then have the client's own subsequent state-changing requests to that path served from the stale cache entry without ever reaching the origin, an integrity failure that occurs under the interceptor's default configuration. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.

TuxCare rebuilt undici to address 7 CVEs. Fixed in 7.29.0-tuxcare.2.

TuxCare rebuilt undici to address 1 CVE. Fixed in 7.28.0-tuxcare.4.

TuxCare rebuilt undici to address 15 CVEs. Fixed in 7.24.4-tuxcare.2.

TuxCare rebuilt undici-types to address 7 CVEs. Fixed in 7.29.0-tuxcare.2.

This update for pi-coding-agent fixes the following issues:

Changes in pi-coding-agent:

• Update to version 1.0.4 (1.0.3 was superseded the same day and never submitted):

  • BREAKING: provider azure-openai-responses renamed to azure, now also serving Azure Foundry Chat Completions (azure/deepseek-v4-pro first). Rename the provider key in auth.json (or run /login again), models.json and settings.json (defaultProvider, enabledModels and modelThinkingLevels); sessions on the old provider fall back and lose prompt cache. AZURE_OPENAI_* env vars unchanged
  • --tools and --exclude-tools take *-patterns and --no-mcp disables MCP for one run; --tools keeps MCP tools unless an entry starts with mcp__
  • Codemode read() on image files yields an image block image() shows, and image() also saves each image to a temp file for later turns
  • Fix fenced-code highlighting past the first line, MCP OAuth native-client registration, MCP shutdown racing a connecting server, Bedrock stalled-stream retries and frozen codemode built-ins, plus ChatGPT-login, EIO-on-closed-terminal and output-file-permission fixes
  • Many more fixes and improvements; see upstream's release notes for the full list

• Refresh the vendored node_modules 1.0.2 -> 1.0.4: the ten @earendil-works packages move to 1.0.4; nanoid, postcss and vite move too but are dev-only and not shipped. Still 119 shipped modules and the licence union is unchanged

  • CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above the 5.0.10 fix floor, so the package is not affected by it
  • CVE-2026-102277 (boo#1283392) and CVE-2026-102278 (boo#1283412): brace-expansion is 5.0.12, at the 5.0.12 and above the 5.0.11 fix floors, so the package is not affected by them

• Update to version 1.0.2: patch releases on the 1.0 API, with no breaking changes

  • models.json takes samplingParamsByThinkingLevel next to the existing samplingParams, so an OpenAI-compatible model can set temperature, top_p and the like separately for off, minimal, low, medium, high, xhigh and max. Model defaults, the effective level's override and the request are merged per key, modelOverrides merges per level, and the levels are pi's own, not the provider's thinkingLevelMap values. Only openai-completions, openai-responses and azure-openai-responses apply them
  • MCP servers can be enabled, disabled or re-scoped per project from a .pi/mcp.json entry without a command or url, and /mcp toggles a user-level server for the current project
  • oauth.clientRegistration: "cimd" identifies pi by its Client ID Metadata Document instead of dynamic client registration
  • pi.registerToolRenderer() picks how calls to a tool that is not registered yet are drawn, such as MCP tools in a resumed session
  • Cloudflare's Clef and Clef Flash classifier models are usable from codemode scripts and extensions
  • A codemode script printing in a loop now fails at 16 Mi characters or 100000 items instead of running pi out of memory
  • MCP tool calls in resumed sessions and HTML exports no longer render fully expanded until their server connects
  • JPEG, GIF and WebP images that extensions draw through Image now appear in Kitty, Ghostty, WezTerm and Warp, and fullscreen Kitty images no longer collapse to a one-row strip after scrolling in WezTerm
  • Many more fixes and improvements; see upstream's release notes for the full list

• Refresh the vendored node_modules over 1.0.0 -> 1.0.2: the ten @earendil-works packages move to 1.0.2, with pi-telemetry the one that was already at 1.0.2 in the 1.0.1 tree, plus @anthropic-ai/sdk to 0.129.0. No module leaves or joins the 119 shipped ones and the licence union is unchanged

  • CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above the 5.0.10 fix floor, so the package is not affected by it. Upstream's 1.0.1 made…

Root has patched CVE-2026-85008 in the undici package for Root:npm. Multiple fixed versions available.