CVE-2026-93748 Details
Description
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
A vulnerability in the http-cache-semantics library, affecting versions through 4.2.0, allows unauthenticated attackers to access cached responses belonging to other users. This issue arises from improper validation of security-zeroed cache entries when handling client max-stale directives. Attackers can exploit this by requesting the same URL with a large max-stale value, thereby retrieving another user's Set-Cookie session credentials from shared-cache entries that were intentionally zeroed for security purposes.
Update the http-cache-semantics library to version 4.2.0 or later, where this vulnerability is addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kornelski/http-cache-semantics/issues/56 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/kornelski/http-cache-semantics | [email protected] | Vendor |
| https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441 | [email protected] | Source CodeVendor |
| https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623 | [email protected] | Source CodeVendor |
| https://github.com/kornelski/http-cache-semantics/issues/56 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-524 | Use of Cache Containing Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kornelski http-cache-semantics | <= 4.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |