CVE-2025-69202: axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header
Summary
CVE-2025-69202: axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header. Affects axios-cache-interceptor versions < 1.11.1. Fixed in 1.11.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
axios-cache-interceptor is a popular library in the npm ecosystem that enables caching of HTTP requests made with Axios. It is designed to enhance performance by reducing the number of requests to upstream services. However, this library has a critical vulnerability that arises from its method of generating cache keys, which does not take into account the Authorization header. This oversight can lead to serious security issues, particularly in server-side applications that handle requests from multiple users with different authentication tokens.
Vulnerability Detail
The vulnerability stems from the way axios-cache-interceptor generates cache keys solely based on the URL, ignoring important request headers such as Authorization. When a server responds with a Vary: Authorization header, indicating that the response can differ based on the auth token, axios-cache-interceptor fails to account for this, resulting in all requests sharing the same cache. This can lead to authorization bypass, where users receive incorrect cached data, potentially exposing sensitive information across different authenticated sessions.
How To Fix
Minimum fixed version
1.11.1
This is the first release that contains the fix.
npm install axios-cache-interceptor@1.11.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing a custom caching strategy that includes the Authorization header in the cache key generation. Below is an example of how to manually create a cache key that includes the Authorization header:
const cacheKey = `${url}-${authHeader}`;
const response = await cachedAxios.get(url, { headers: { Authorization: authHeader, cacheKey } });
Conclusion
The axios-cache-interceptor library has a significant vulnerability that can lead to cache poisoning and authorization bypass. It is crucial for developers using this library in server-side applications to upgrade to version 1.11.1 or later to mitigate the risk. Implementing a custom caching strategy can serve as a temporary workaround until the upgrade is completed.
See every vulnerability recorded for axios-cache-interceptor →
FAQ
The vulnerability can lead to authorization bypass, where users may receive cached responses intended for other users, exposing sensitive data.
Server-side applications that use axios-cache-interceptor to cache requests from multiple users with different authentication tokens are affected.
You can use Vulert, which monitors open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 6.0, indicating a moderate level of severity.
No, the upgrade to version 1.11.1 or later does not require any code changes as the protection is automatic.
