AIKIDO-2026-515241

TL;DR

Thruster creates cache keys from an unverified 64-bit FNV-1 digest of the request method, path, query string, host, and Vary selected values, but does not retain the original request to verify cache hits. An attacker who can cache a public response containing untrusted bytes can choose a path whose digest collides with a victim request, including non-GET methods, WebSocket upgrades, and range requests, because CacheHandler.ServeHTTP returns the cached response before checking shouldCacheRequest. The victim then receives the malicious cached response, and the request never reaches the upstream application. The fix uses a stronger cache key so a collision cannot substitute a malicious cached response for an unrelated request.