GHSA-ch52-4w7c-c8xp CVE-2026-93748
Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses
- Severity
- 8.7 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.57%
- Chance of exploitation in the next 30 days. Higher than 47.15% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-524 Use of Cache Containing Sensitive Information
- Fix
- None yet
- No fixed version published
Description
Withdrawn Advisory
This advisory has been withdrawn because it's not a valid vulnerability. This link is maintained to preserve external references.
Original Description
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| http-cache-semantics | <= 4.2.0 |
No fix yet |
| http-cache-semantics | <= 4.2.0 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-524: Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
How to prevent it
- Architecture and Design: Protect information stored in cache.
- Architecture and Design: Do not store unnecessarily sensitive information in the cache.
- Architecture and Design: Consider using encryption in the cache.
References
Advisories
Other links
- github.com/kornelski/http-cache-semantics/issues/56
- github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e…
- github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e…
- github.com/kornelski/http-cache-semantics/issues/56
- github.com/kornelski/http-cache-semantics
Timeline
- Published
- Withdrawn
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rc47-6667-2j5j http-cache-semantics vulnerable to Regular Expression Denial of Service | High | Also affects http-cache-semantics |
| GHSA-4w7w-5xrc-9h26 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects | Critical | Same weakness, CWE-524 |
| GHSA-5974-gfqc-wrcm Contao: Improper access control in the table access voter | Medium | Same weakness, CWE-524 |
| GHSA-935w-9g4m-p28p vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle | Low | Same weakness, CWE-524 |
| GHSA-3w37-wq28-93x7 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages | Medium | Same weakness, CWE-524 |
| GHSA-4jqv-mc3x-m676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications | Medium | Same weakness, CWE-524 |
| GHSA-mcj8-r9mp-w47p Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service | Medium | Same weakness, CWE-524 |
| GHSA-h694-7cp9-m8p3 next.js cache leak across root param values in nested 'use cache' functions | Medium | Same weakness, CWE-524 |
Credits: mazze93
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor