Axios-cache-interceptor is a caching library for axios HTTP client that improves performance by caching upstream service responses. Prior to version 1.11.1, the library generated cache keys based only on the request URL, ignoring request headers such as Authorization. When an upstream service responds with a Vary: Authorization header, it indicates that the response content varies depending on the Authorization token used. However, axios-cache-interceptor ignored this header, causing all requests to share the same cached response regardless of differing auth tokens. This results in server-side applications (such as APIs, proxies, or backend services) that handle multiple users with different authorization tokens receiving cached responses intended for other users. Consequently, this leads to authorization bypass and leakage of sensitive information across authenticated sessions. The vulnerability is tracked as CVE-2025-69202 and is categorized under CWE-524 (Use of Cache Containing Sensitive Information), CWE-573 (Improper Handling of HTTP Vary Header), and CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 4.0 score is 6.0 (medium severity), reflecting network attack vector, high complexity, partial privileges required, no user interaction, and high impact on confidentiality. The issue is fixed in version 1.11.1 by enabling automatic support for the Vary header, including the Authorization header value in cache keys, ensuring cache isolation per user token. Browser or client-side applications are not affected since they typically handle a single user session. No known exploits are reported in the wild as of now.

For European organizations, this vulnerability poses a significant risk of unauthorized data disclosure and privacy breaches, especially for those operating multi-tenant backend services, API gateways, or proxies that cache responses from upstream services using axios-cache-interceptor. Sensitive user data could be leaked across different authenticated sessions, violating GDPR and other data protection regulations. The impact includes loss of confidentiality, potential regulatory fines, reputational damage, and erosion of customer trust. Organizations relying on microservices architectures or cloud-native applications that use axios-cache-interceptor for caching authenticated requests are particularly vulnerable. The flaw could be exploited by attackers or malicious insiders with low privileges to access data belonging to other users without proper authorization. Although exploitation complexity is high due to the need for specific caching and header conditions, the widespread use of axios and caching libraries in modern web applications increases the attack surface. The vulnerability does not affect client-side applications, limiting the scope to server-side deployments. Overall, the impact is medium but with potential for serious data breaches if left unmitigated.

European organizations should immediately upgrade axios-cache-interceptor to version 1.11.1 or later, where the vulnerability is fixed by including the Authorization header in cache keys when the upstream service responds with Vary: Authorization. Additionally, organizations should audit all backend services and API gateways that use axios-cache-interceptor or similar caching mechanisms to ensure proper handling of Vary headers and authorization tokens. Implement strict cache key generation policies that incorporate all headers affecting response content, especially Authorization. Conduct thorough code reviews and penetration testing focused on caching logic and authorization enforcement. Where possible, disable caching of sensitive authenticated responses or use cache partitioning per user session. Monitor logs for anomalous cache hits or unexpected data access patterns. Educate developers about the security implications of caching sensitive data and the importance of respecting HTTP caching semantics. Finally, maintain an inventory of all services using axios-cache-interceptor to ensure timely patching and compliance with data protection requirements.