AIKIDO-2026-10308

TL;DR

Affected versions of this package are vulnerable to cache poisoning. The default cache key implementation generates cache keys using only the URI path and does not include other important request attributes such as the Host header. This allows an attacker to poison shared cache entries and cause cross-origin responses to be served to users. In multi-tenant deployments, this may lead to cross-tenant data leakage or the delivery of malicious content to legitimate users. The issue is addressed by removing the insecure default cache key implementation and requiring users to explicitly define their own cache key logic.