CVE-2025-69202: 
JavaScript vulnerability analysis and mitigation

CVE-2025-69202 is a cache poisoning vulnerability in the axios-cache-interceptor npm package, allowing authenticated users to receive cached responses intended for other users, effectively bypassing authorization controls. The flaw affects all versions prior to 1.11.1 of axios-cache-interceptor for Node.js. It was disclosed on December 29, 2025, by reporter kishore03109 via a GitHub Security Advisory. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.0 (Medium) (Github Advisory, Security Advisory).

The root cause is that the library generates cache keys solely from the request URL, completely ignoring request headers such as Authorization (CWE-524, CWE-573, CWE-639). When an upstream service responds with a Vary: Authorization header — signaling that responses differ per auth token — axios-cache-interceptor ignores this directive and serves the same cached response to all users regardless of their token. This means the first authenticated user's response is cached and returned to all subsequent users making requests to the same URL, even with different Bearer tokens. The vulnerability is exploitable in server-side applications (APIs, proxies, backend services) that use the library to proxy requests to upstream services on behalf of multiple users; browser/client-side single-user applications are not affected (Security Advisory, Github Advisory).

Exploitation results in unauthorized cross-user data disclosure: an authenticated attacker with valid credentials can receive cached responses containing sensitive data belonging to other authenticated users, constituting a high-confidentiality impact. In multi-tenant or multi-user backend systems, this can lead to significant data breaches, as any user's data cached by the server becomes accessible to other users making requests to the same endpoint. There is no integrity or availability impact, but the potential for lateral data exposure across authenticated sessions is significant in shared-service architectures (Security Advisory, Github Advisory).

A public proof-of-concept (PoC) is included in the official GitHub Security Advisory, demonstrating that all 10 concurrent requests return the first user's cached data regardless of the Authorization token used. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.037% (11th percentile), indicating a low near-term exploitation probability. No threat actor attribution has been reported (Github Advisory, Security Advisory).

1. Identify a vulnerable target: Locate a server-side application (API, proxy, or backend service) that uses axios-cache-interceptor < 1.11.1 to proxy requests to an upstream service that returns Vary: Authorization in its responses.
2. Obtain valid credentials: Acquire a legitimate authentication token (e.g., Bearer 456) for the target application — this can be a free trial or low-privilege account.
3. Trigger cache population: Ensure another user (or wait for one) to make a request to the target endpoint first, causing their response (e.g., for Bearer 123) to be stored in the shared cache keyed only by URL.
4. Send a request with your own token: Make a GET request to the same endpoint with your own Authorization: Bearer 456 header. Because the cache key ignores the Authorization header, the server returns the previously cached response for Bearer 123.
5. Receive cross-user data: The attacker receives the other user's sensitive data (e.g., personal information, account details) from the poisoned cache, bypassing authorization checks entirely (Security Advisory, Github Advisory).

• Logs: Application logs showing multiple different Authorization header values (different Bearer tokens) receiving identical response bodies or cache hit indicators for the same URL endpoint.
• Logs: Unexpected response.cached: true log entries in Node.js applications using axios-cache-interceptor for requests made with different auth tokens to the same URL.
• Network: Upstream service access logs showing fewer requests than expected relative to the number of distinct authenticated users — indicating responses are being served from cache rather than forwarded upstream.
• Application Behavior: User-reported data anomalies where authenticated users receive data belonging to other users for the same API endpoint (Security Advisory).

Upgrade axios-cache-interceptor to version 1.11.1 or later; no code changes are required as Vary header support is automatically enabled by default in this version, ensuring cache keys include the Authorization header value when the upstream responds with Vary: Authorization. For teams unable to upgrade immediately, workarounds include: disabling caching entirely for authenticated requests, or implementing a custom cache key generator that incorporates the Authorization header value as part of the key. The fix was committed in commit 49a8080 and published December 29, 2025 (Github Advisory, Security Advisory).

The vulnerability was reported by security researcher kishore03109 and remediated by the library's author arthurfiorette, who published the advisory and patch on December 29, 2025. The advisory was picked up by automated vulnerability tracking services including Vulners, CIRCL Vulnerability Lookup, and CVEFeed shortly after disclosure. Social media activity was limited to automated CVE tracking accounts on Bluesky. No significant independent researcher commentary or media coverage has been identified beyond standard vulnerability database aggregation (Github Advisory).