Description
When a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass.
Recommendation
Update the axios-cache-interceptor package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.11.1
- Patched version(s): 1.11.1
References
Could your website be exposed too?
SmartScanner can check your website for axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header and gives you actionable findings to investigate.
Start a free scanRelated Issues
- webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence - CVE-2025-68157
- ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header - CVE-2026-55087
- FUXA has JWT Authentication Bypass via HTTP Referer header spoofing - CVE-2025-69985
- axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL - CVE-2025-27152
You might also like:
See something that needs correcting? Let us knowUpdated January 05, 2026