All vulnerabilities
CVE-2026-93748GHSA-ch52-4w7c-c8xp

http-cache-semantics max-stale handling can disclose cross-user cached responses

kornelski http-cache-semanticsnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.57%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published18 Sep 2026Updated 14 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.

Text from CVE List

Affected versions 3

  • http-cache-semantics, npm<= 4.2.0GitHub
  • http-cache-semanticsaffected: all versions through 4.2.0CVE List
  • http-cache-semantics, npmfrom first release, through 4.2.0OSV

References 8