CVE-2026-93750 Details
Description
http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.
A cache validation vulnerability has been identified in the http-cache-semantics library, versions through 4.2.0. The issue resides in the _varyMatches() function, where the library fails to properly validate Vary header wildcards due to a byte-for-byte string comparison. This flaw allows attackers to request URLs that were previously fetched by other clients and receive cached responses intended for different users, thereby disclosing sensitive information across clients.
Users are advised to update to version 4.2.1, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kornelski/http-cache-semantics/issues/57 | CISA-ADP | Issue TrackingTechnical DescriptionVendor |
| https://github.com/kornelski/http-cache-semantics | [email protected] | Source CodeVendor |
| https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501 | [email protected] | Source CodeVendor |
| https://github.com/kornelski/http-cache-semantics/issues/57 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-client-cache-disclosure-via-vary-wildcard | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kornelski http-cache-semantics | <= 4.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | New CVE Received | [email protected] |
| Sep 18, 2026 | CVE Modified | CISA-ADP |