Live › vulnerability › CVE-2026-93748
Go to dashboardThe advisory says http-cache-semantics through 4.2.0 mishandles client max-stale requests, so cached responses belonging to other users could be returned. The advisory was withdrawn by its publisher as not a valid vulnerability, so the claim is unconfirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 21:17 UTC, 0h before NVD. All times on this page are UTC.
The withdrawal means the advisory itself does not establish exposure. Teams using http-cache-semantics in a shared cache that serves responses to multiple users would be the only ones to look at, and only if they cannot confirm the withdrawal reasoning. unknown whether the withdrawal reflects a disproven issue or a duplicate.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| http-cache-semantics | npm | <= 4.2.0 | – |
npm ls http-cache-semantics to see whether the package is in the dependency tree and at what versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it's not a valid vulnerability. This link is maintained to preserve external references.
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
This page as .md · .json · in your agent: get_signal("CVE-2026-93748")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.