fix(cache): reject unsafe method response caching

Restrict cache reads and writes to safe HTTP methods while preserving successful unsafe-method invalidation. This prevents responses to methods such as POST or DELETE from being stored and replayed.

Fixes: GHSA-8436-99hf-9mmv
CVE: CVE-2026-85008
Signed-off-by: Matteo Collina <hello@matteocollina.com>
(cherry picked from commit c655ee00ef5cb3272a46000be8b37c9ec8b295c5)
(cherry picked from commit 92b90886b79091235e710df920bcf2351653279b)

Author: mcollina

lib/handler/cache-handler.js

@@ -224,7 +224,7 @@ class CacheHandler {
     }
 
     const cacheControlDirectives = cacheControlHeader ? parseCacheControlHeader(cacheControlHeader) : {}
-    if (!canCacheResponse(this.#cacheType, statusCode, resHeaders, cacheControlDirectives, this.#cacheKey.headers)) {
+    if (!canCacheResponse(this.#cacheType, this.#cacheKey.method, statusCode, resHeaders, cacheControlDirectives, this.#cacheKey.headers)) {
       if (statusCode === 304 && (cacheControlHeader || revalidationResponseDisallowsCachedReuse(this.#cacheType, resHeaders, cacheControlDirectives))) {
         deleteCachedValue(this.#store, this.#cacheKey)
       }
@@ -473,12 +473,16 @@ function revalidationResponseDisallowsCachedReuse (cacheType, resHeaders, cacheC
  * @see https://www.rfc-editor.org/rfc/rfc9111.html#name-storing-responses-to-authen
  *
  * @param {import('../../types/cache-interceptor.d.ts').default.CacheOptions['type']} cacheType
+ * @param {string} method
  * @param {number} statusCode
  * @param {import('../../types/header.d.ts').IncomingHttpHeaders} resHeaders
  * @param {import('../../types/cache-interceptor.d.ts').default.CacheControlDirectives} cacheControlDirectives
  * @param {import('../../types/header.d.ts').IncomingHttpHeaders} [reqHeaders]
  */
-function canCacheResponse (cacheType, statusCode, resHeaders, cacheControlDirectives, reqHeaders) {
+function canCacheResponse (cacheType, method, statusCode, resHeaders, cacheControlDirectives, reqHeaders) {
+  if (!arrayIncludes(util.safeHTTPMethods, method)) {
+    return false
+  }
   // Status code must be final and understood.
   if (statusCode < 200 || arrayIncludes(NOT_UNDERSTOOD_STATUS_CODES, statusCode)) {
     return false

lib/interceptor/cache.js

@@ -574,6 +574,11 @@ module.exports = (opts = {}) => {
        * @type {import('../../types/cache-interceptor.d.ts').default.CacheKey}
        */
       const cacheKey = makeCacheKey(opts)
+
+      if (!arrayIncludes(util.safeHTTPMethods, opts.method)) {
+        return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler))
+      }
+
       const result = store.get(cacheKey)
 
       if (result && typeof result.then === 'function') {

test/interceptors/cache.js

@@ -931,6 +931,82 @@ describe('Cache Interceptor', () => {
     }
   })
 
+  test('unsafe methods are not served from cache', async () => {
+    // A heuristically-cacheable response (404) with an explicit max-age would
+    // previously be stored under the unsafe method and replayed on a second,
+    // identical state-changing request without ever hitting the origin.
+    let requestsToOrigin = 0
+    const server = createServer((req, res) => {
+      requestsToOrigin++
+      res.statusCode = 404
+      res.setHeader('cache-control', 'max-age=60')
+      res.end(`origin-hit-#${requestsToOrigin}`)
+    }).listen(0)
+
+    after(() => server.close())
+
+    const client = new Client(`http://localhost:${server.address().port}`)
+      .compose(interceptors.cache({
+        store: new MemoryCacheStore()
+      }))
+
+    for (const method of ['POST', 'PUT', 'PATCH', 'DELETE']) {
+      const req = { origin: 'localhost', method, path: '/resource/123' }
+      const before = requestsToOrigin
+
+      const res1 = await client.request(req)
+      const body1 = await res1.body.text()
+
+      const res2 = await client.request(req)
+      const body2 = await res2.body.text()
+
+      // Every unsafe-method request must reach the origin; none may be served from cache.
+      equal(requestsToOrigin - before, 2)
+      equal(body1, `origin-hit-#${before + 1}`)
+      equal(body2, `origin-hit-#${before + 2}`)
+    }
+
+    await client.close()
+  })
+
+  test('successful unsafe methods still invalidate cached entries', async () => {
+    // The fix routes unsafe methods through CacheHandler (not a bare dispatch) so a
+    // successful unsafe request keeps invalidating an existing cached GET for the same path.
+    let requestsToOrigin = 0
+    const server = createServer((req, res) => {
+      requestsToOrigin++
+      if (req.method === 'GET') {
+        res.statusCode = 200
+        res.setHeader('cache-control', 'max-age=60')
+      } else {
+        res.statusCode = 200
+      }
+      res.end(`origin-hit-#${requestsToOrigin}`)
+    }).listen(0)
+
+    after(() => server.close())
+
+    const client = new Client(`http://localhost:${server.address().port}`)
+      .compose(interceptors.cache({
+        store: new MemoryCacheStore()
+      }))
+
+    const get = { origin: 'localhost', method: 'GET', path: '/resource/123' }
+
+    await (await client.request(get)).body.text()
+    const afterPrime = requestsToOrigin
+    await (await client.request(get)).body.text()
+    equal(requestsToOrigin, afterPrime) // second GET served from cache
+
+    await (await client.request({ origin: 'localhost', method: 'POST', path: '/resource/123' })).body.text()
+
+    const beforeFinalGet = requestsToOrigin
+    await (await client.request(get)).body.text()
+    equal(requestsToOrigin - beforeFinalGet, 1) // GET re-fetched after invalidation
+
+    await client.close()
+  })
+
   test('necessary headers are stripped', async () => {
     const headers = [
       // Headers defined in the spec that we need to strip