Summary
Nitro's cached event handlers could reuse responses across HTTP methods and replay per-user Set-Cookie headers to other visitors, leaking session identifiers and enabling session fixation. They also ignored private/no-store/no-cache directives and response Vary headers, allowing private responses into shared caches. Affects nitropack versions before 2.13.6 when applications use defineCachedEventHandler/cachedEventHandler or cache, swr, or isr route rules, including affected Nuxt setups. Applications without these caching features are not affected. Fixed in 2.13.6.
Disclosure timeline
- Public disclosure
Credits
Reported by christos-cantina-security, as credited in Nitro's advisory.