Better Call routing bug can lead to Cache Deception

Description

Using a CDN that caches (/**/*.png, /**/*.json, /**/*.css, etc…) requests, a cache deception can emerge. This could lead to unauthorized access to user sessions and personal data when cached responses are served to other users.

Recommendation

Update the better-call package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.12
• Patched version(s): 1.0.12

References

• GHSA-hq75-xg7r-rx6c
• CWE-525
• OWASP 2021-A4

Related Issues

• Failure to sanitize quotes which can lead to sql injection in squel - Vulnerability
• content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE - CVE-2025-55164
• Axios: Prototype pollution gadgets can alter axios request construction - Vulnerability
• javascript-deobfuscator crafted payload can lead to code execution - CVE-2024-36120

You might also like:

Better Passive Vulnerability Testing with SmartScanner version 1.7

The Best Ebooks Beginners and Experienced Programmers Alike Can Read to Get Better at Secure Coding

5 Security Vulnerabilities You Can Fix Right Now

Tags:

npm

better-call