CWE-524: Use of Cache Containing Sensitive Information

The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Applications may use caches to improve efficiency when communicating with remote entities or performing intensive calculations. A cache maintains a pool of objects, threads, connections, pages, financial data, passwords, or other resources to minimize the time it takes to initialize and access these resources. If the cache is accessible to unauthorized actors, attackers can read the cache and obtain this sensitive information.

Consequences

• Confidentiality: Read Application Data

How to prevent it

• Architecture and Design: Protect information stored in cache.
• Architecture and Design: Do not store unnecessarily sensitive information in the cache.
• Architecture and Design: Consider using encryption in the cache.

Recent advisories

• GHSA-4w7w-5xrc-9h26 — undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
• GHSA-5974-gfqc-wrcm — Contao: Improper access control in the table access voter
• GHSA-935w-9g4m-p28p — vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle
• GHSA-3w37-wq28-93x7 — Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
• GHSA-4jqv-mc3x-m676 — Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
• GHSA-mcj8-r9mp-w47p — Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
• GHSA-h694-7cp9-m8p3 — next.js cache leak across root param values in nested 'use cache' functions
• EEF-CVE-2026-89186 — mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches
• EEF-CVE-2026-82755 — ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
• GHSA-2jfj-6hjv-fm6j — undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
• GHSA-8c42-7qj2-3j46 — Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
• GHSA-wm8w-6qjm-cv43 — Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
• GHSA-jr45-8vmc-qm54 — undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
• GHSA-68g3-v927-f742 — Next.js: Cache confusion of response bodies for requests with bodies
• GHSA-c6w9-5g5j-jh2p — Directus: Authorization-dependent response served from unsegmented cache key

All advisories for CWE-524