AIKIDO-2026-988529
axios-cache-interceptor is vulnerable to Information Disclosure
23
Low Risk
This Affects:
axios-cache-interceptorTL;DR
axios-cache-interceptor deduplicates concurrent requests that share the same cache key. When the first response carries a Vary: * header it is stored as stale, but requests already waiting on that request could still consume its response instead of issuing their own upstream request. In server-side applications that share a cache instance across users, a waiting request whose headers differ, such as Authorization or Cookie, could receive another caller's response. The fix treats Vary: * as an unconditional cache mismatch so waiting requests make their own upstream request.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you share an axios-cache-interceptor instance across users in a server-side application that makes concurrent requests to an upstream resource returning Vary: *.
Background info
axios-cache-interceptor is vulnerable to Information Disclosure in versions 0.0.1 - 1.12.2.
How to fix this
Upgrade the axios-cache-interceptor library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant