Axios Cache Interceptor
Monthly
Cached HTTP responses can be served to the wrong authenticated user in axios-cache-interceptor before 1.11.1, leaking data across sessions and bypassing authorization checks in server-side deployments. The library builds its cache key from the request URL alone and ignores the upstream's `Vary: Authorization` response header, so when a backend, proxy, or API serves multiple users with different bearer tokens through a single cache instance, an authenticated attacker holding a valid low-privileged token (CVSS PR:L) who requests the same URL can receive another user's cached response; exploitation is timing- and configuration-dependent because the victim's response must already be cached. Publicly available exploit code exists (a full proof-of-concept is published in the GitHub advisory), while EPSS is low at 0.32% (22nd percentile) and CISA KEV does not list this issue, making this a genuine but conditional authorization-bypass flaw of moderate rather than urgent risk.
Cached HTTP responses can be served to the wrong authenticated user in axios-cache-interceptor before 1.11.1, leaking data across sessions and bypassing authorization checks in server-side deployments. The library builds its cache key from the request URL alone and ignores the upstream's `Vary: Authorization` response header, so when a backend, proxy, or API serves multiple users with different bearer tokens through a single cache instance, an authenticated attacker holding a valid low-privileged token (CVSS PR:L) who requests the same URL can receive another user's cached response; exploitation is timing- and configuration-dependent because the victim's response must already be cached. Publicly available exploit code exists (a full proof-of-concept is published in the GitHub advisory), while EPSS is low at 0.32% (22nd percentile) and CISA KEV does not list this issue, making this a genuine but conditional authorization-bypass flaw of moderate rather than urgent risk.