Executive brief
axios-cache-interceptor is a widely-used Node.js library for caching HTTP requests made by server-side applications. The library incorrectly caches responses without considering the HTTP Vary header, which servers use to indicate that a response depends on specific request headers like Authorization. This flaw allows different users' requests with different authentication credentials to return the same cached response, enabling one user to receive another user's private data and bypassing authorization checks.
Technical details
The vulnerability is a cache-poisoning attack caused by improper cache key generation. The library generates cache keys using only the request URL while ignoring critical HTTP headers such as Authorization. When an upstream server responds with a Vary: Authorization header (indicating the response differs based on authorization credentials), axios-cache-interceptor ignores this signal and continues to treat all requests to the same URL as identical, regardless of authentication token. An attacker with low privileges who can make authenticated requests to a server-side application can exploit this by sending requests with different auth tokens; subsequent requests with different credentials will incorrectly receive cached responses from earlier requests, leaking sensitive data across authentication boundaries. The issue affects server-side applications (APIs, proxies, backend services) that use axios-cache-interceptor to cache upstream requests and handle multiple authenticated users. The fix was released in version 1.11.1, which automatically respects Vary headers and includes them in the cache key without requiring configuration changes.
Affected products
- Arthur Fiorette axios-cache-interceptor < 1.11.1
Timeline
- 2025-12-29: disclosed: NVD published
- 2025-12-30: disclosed: GitHub advisory published
- 2025-12-30: patched: Fix released in version 1.11.1