CVE-2025-69202 axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header

Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass. The cache key is generated only from the URL, ignori...

@0xecho/button (>=0.0.1, <=0.0.17), @adamstankiewicz/openedx-frontend-platform (>=8.2.0, <=8.3.6) +105 more potentially affected by CVE-2025-69202 via axios-cache-interceptor (>=0.2.0, <=1.8.3)

axios-cache-interceptor NPM version =0.2.0, =0.0.1, =8.2.0, =1.0.1, =1.6.3, =0.4.0, =0.0.1, =1.0.8-beta.15, =1.1.0, =1.3.1 - @depup/directus 11.16.1-depup.0 - @devix-tecnologia/utils-ts 1.0.0 and more Source cves: CVE-2025-69202 Source advisory: MEND:CVE-2025-69202...

PT-2025-53783

Name of the Vulnerable Software and Affected Versions Axios Cache Interceptor versions prior to 1.11.1 Description Axios Cache Interceptor, a cache interceptor for axios, improperly handles responses with the Vary: Authorization header. Prior to version 1.11.1, the cache key was generated solely...

Axios Cache Interceptor security vulnerability

Axios Cache Interceptor is a cache interceptor by the individual developer Arthur Fiorette. A security vulnerability exists in Axios Cache Interceptor versions prior to 1.11.1, which stems from cache key generation ignoring the authorization header, which could lead to authorization bypass...

CVE-2025-69202: Use of Cache Containing Sensitive Information

Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass. The cache key is generated only from the URL, ignori...