CWE-525: Use of Web Browser Cache Containing Sensitive Information
Variant
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
Consequences
- Confidentiality: Read Application Data
How to prevent it
- Architecture and Design: Protect information stored in cache.
- Implementation: Use a restrictive caching policy for forms and web pages that potentially contain sensitive information, such as "no-cache" in the Cache-Control header.
- Architecture and Design: Do not store unnecessarily sensitive information in the cache.
- Architecture and Design: Consider using encryption in the cache.
Recent advisories
- DRUPAL-CONTRIB-2026-165 — The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.
- GHSA-4cwx-7wf7-3272 — undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
- DRUPAL-CORE-2025-008 — Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
- GHSA-6533-fhr2-f38h — Liferay Portal and DXP use an incorrect cache-control header
- GHSA-9xpj-62mm-24h2 — Apache Airflow does not return the "Cache-Control" header for dynamic content
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor