CVE-2025-69202
High · 7.1axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header
CVSS
7.1
EPSS
0.3%
Published
Dec 30, 2025
CISA due date
—
The record
When a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | axios-cache-interceptor | 0 | 1.11.1 |
Related vulnerabilities
- GHSA-x4m5-4cw8-vc44 axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header Same vulnerability
- CVE-2026-105711 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before… CWE-524
- CVE-2026-105752 vLLM is an inference and serving engine for large language models. CWE-524
- CVE-2026-94543 Next.js is a React framework for building full-stack web applications. CWE-524
- CVE-2026-94484 Next.js is a React framework for building full-stack web applications. CWE-524
- CVE-2026-93748 http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache… CWE-524
- CVE-2026-88059 Angular is a development platform for building mobile and desktop web applications using… CWE-524
- CVE-2026-82755 Use of Cache Containing Sensitive Information vulnerability in ash-project… CWE-524