Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

axios-cache-interceptor

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.0npmAmendedPublished

    axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header

    CVE-2025-69202 · GHSA-x4m5-4cw8-vc44

    Affected
    • npm axios-cache-interceptor < 1.11.1
    Fixed in
    1.11.1· Vendor fix available
    Issue
    When a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass. Details The cache key is generated only from the URL, ignoring request headers like Authorization. When the server responds with Vary: Authorization (indicating the response varies by auth token), the library ignores this, causing all requests to share the same cache regardless of authorization. Impact Affected: Server-side applications (APIs, proxies, backend services) that: - Use axios-cache-interceptor to cache requests to upstream services - Handle requests from multiple users with different auth tokens - Upstream services replies on Vary to differentiate caches Not affected: Browser/client-side applications (single user per browser session). Services using different auth tokens to call upstream services will return incorrect cached data, bypassing authorization checks and leaking user data across different…

    Recommended action: Upgrade to 1.11.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →