CVE-2025-69202
📋 TL;DR
Axios Cache Interceptor versions before 1.11.1 incorrectly cache responses without considering Authorization headers, allowing cached responses from one user's authenticated session to be served to other users with different auth tokens. This leads to authorization bypass and potential data leakage across user sessions. Only server-side applications using axios-cache-interceptor to call upstream services with different auth tokens are affected.
💻 Affected Systems
- axios-cache-interceptor
📦 What is this software?
Axios Cache Interceptor by Axios Cache Interceptor
⚠️ Risk & Real-World Impact
Worst Case
Sensitive user data from one authenticated session is served to unauthorized users, leading to complete authorization bypass and data leakage across all user sessions.
Likely Case
Users receive cached responses from other users' sessions, potentially exposing personal data, preferences, or authorization tokens to unauthorized parties.
If Mitigated
With proper controls, impact is limited to potential performance degradation from cache misses, but no data leakage occurs.
🎯 Exploit Status
Exploitation requires access to the vulnerable application and understanding of cache behavior. The vulnerability is inherent to the library's design.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.11.1
Vendor Advisory: https://github.com/arthurfiorette/axios-cache-interceptor/security/advisories/GHSA-x4m5-4cw8-vc44
Restart Required: Yes
Instructions:
1. Update axios-cache-interceptor to version 1.11.1 or later. 2. Run npm update axios-cache-interceptor or yarn upgrade axios-cache-interceptor. 3. Restart your application server.
🔧 Temporary Workarounds
Disable caching for requests with Authorization headers
allManually configure axios-cache-interceptor to skip caching for requests that include Authorization headers
// In your axios configuration:
axios.create({
adapter: setupCache(axios.defaults.adapter, {
methods: ['get'],
cachePredicate: {
responseMatch: (response) => !response.config.headers.Authorization
}
})
})
🧯 If You Can't Patch
- Disable axios-cache-interceptor entirely for all requests that use Authorization headers
- Implement application-level caching that properly respects Vary headers and authorization tokens
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/axios-cache-interceptor/package.json for version number. If version is less than 1.11.1, the system is vulnerable.Check Version:
npm list axios-cache-interceptor | grep axios-cache-interceptorVerify Fix Applied:
Verify the installed version is 1.11.1 or higher and test that requests with different Authorization headers do not share cache responses.📡 Detection & Monitoring
Log Indicators:
- Multiple users receiving identical cached responses despite different auth tokens
- Cache hits for requests with varying Authorization headers
Network Indicators:
- Identical response bodies for requests with different Authorization headers
- Missing Vary: Authorization header in upstream service responses
SIEM Query:
Search for identical response payloads across multiple user sessions within short timeframes when using axios-cache-interceptor🔗 References
- https://github.com/arthurfiorette/axios-cache-interceptor/commit/49a808059dfc081b9cc23d48f243d55dfce15f01
- https://github.com/arthurfiorette/axios-cache-interceptor/security/advisories/GHSA-x4m5-4cw8-vc44
- https://github.com/arthurfiorette/axios-cache-interceptor/security/advisories/GHSA-x4m5-4cw8-vc44
