Cache poisoning in popular open source packages

This Snyk research blog post explains web cache poisoning—how unkeyed parameters can cause caches to serve malicious responses—and demonstrates multiple exploitation vectors found in popular open-source web frameworks (e.g., semicolon query-parameter cloaking and GET body parameters in GET requests). The report includes examples and references (including CVEs), describes how proxies and frameworks differ in parsing requests, and recommends mitigations for maintainers and developers (e.g., normalizing query separators, ignoring GET body parameters unless needed, and aligning cache keys with request parsing).