{"id":"CVE-2026-93748","kind":"vulnerability","aliases":["CVE-2026-93748","GHSA-ch52-4w7c-c8xp"],"related":[],"title":"Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses","description":"### Withdrawn Advisory\nThis advisory has been withdrawn because it's not a valid vulnerability. This link is maintained to preserve external references.\n\n### Original Description\nhttp-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.","summary":"The advisory says http-cache-semantics through 4.2.0 mishandles client max-stale requests, so cached responses belonging to other users could be returned. The advisory was withdrawn by its publisher as not a valid vulnerability, so the claim is unconfirmed.","severity":"high","cvss":8.7,"epss":0.00569,"exploited":false,"exploited_at":null,"products":[{"name":"http-cache-semantics","fixed":[],"affected":"<= 4.2.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-524","node","npm","package","shared-cache"],"not_affected_if":["no-shared-cache","withdrawn-advisory"],"how_to_check":"- Run `npm ls http-cache-semantics` to see whether the package is in the dependency tree and at what version\n- Check whether any shared cache sits in front of the application and uses this package","fix":"- No fix needed per the withdrawn advisory; keep the package on a current release such as the latest available from npm\n- unknown: the sources do not name a patched version","status":"withdrawn","published_at":"2026-09-18T18:18:33+00:00","first_seen_at":"2026-10-28T21:17:51+00:00","triaged_at":"2026-10-28T21:19:59+00:00","updated_at":"2026-10-28T21:35:45+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-28T21:19:59Z","model":"claude-haiku-5-5","output":{"fix":"- No fix needed per the withdrawn advisory; keep the package on a current release such as the latest available from npm\n- unknown: the sources do not name a patched version","reach":"internet","title":"http-cache-semantics: max-stale handling may leak cached responses between users","impact":"high","summary":"The advisory says http-cache-semantics through 4.2.0 mishandles client max-stale requests, so cached responses belonging to other users could be returned. The advisory was withdrawn by its publisher as not a valid vulnerability, so the claim is unconfirmed.","category":"package","nicknames":[],"who_cares":["npm","node","shared-cache"],"confidence":0.4,"needs_auth":"no","worst_case":"Another user's cached session cookie could be returned, if the claim holds.","analyst_note":"Advisory is withdrawn as not valid; check GHSA-ch52-4w7c-c8xp and the http-cache-semantics repository for the withdrawal reason before alerting teams.","how_to_check":"- Run `npm ls http-cache-semantics` to see whether the package is in the dependency tree and at what version\n- Check whether any shared cache sits in front of the application and uses this package","needs_analyst":true,"not_affected_if":["no-shared-cache","withdrawn-advisory"],"who_is_affected":"The withdrawal means the advisory itself does not establish exposure. Teams using http-cache-semantics in a shared cache that serves responses to multiple users would be the only ones to look at, and only if they cannot confirm the withdrawal reasoning. unknown whether the withdrawal reflects a disproven issue or a duplicate.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000646,"input_tokens":3466,"output_tokens":599,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,27A '-524':34B '-93748':20A,28A '4.2.0':49B,112C '4w7c':24A 'advisori':2A,42B,67B,84C,86C 'allow':129C 'anoth':155C 'attack':131C,140C 'belong':59B,136C 'c8xp':25A 'cach':5A,16A,40B,46B,57B,109C,120C,134C,166C 'cache':31A 'ch52':23A 'claim':80B 'client':51B,124C 'cooki':160C 'could':63B 'credenti':162C 'cross':14A 'cross-us':13A 'cve':18A,26A 'cwe':33B 'deliber':170C 'descript':106C 'direct':128C 'disclos':12A 'entri':121C,167C 'extern':103C 'fail':113C 'ghsa':22A 'ghsa-ch52-4w7c-c8xp':21A 'handl':10A 'http':4A,30A,45B,108C 'http-cache-semant':3A,44B,107C 'http-cache-semantics':29A 'larg':148C 'link':98C 'maintain':100C 'max':8A,53B,126C,150C 'max-stal':7A,52B,125C,149C 'mishandl':50B 'node':35B 'npm':36B 'obtain':154C 'origin':105C 'packag':37B 'preserv':102C 'process':123C 'proper':115C 'publish':72B 'reason':174C 'refer':104C 'request':55B,142C 'respons':17A,58B,135C 'retriev':133C 'return':65B 'say':43B 'secur':118C,173C 'security-zero':117C 'semant':6A,47B,110C 'semantics':32A 'session':161C 'set':159C 'set-cooki':158C 'share':39B,165C 'shared-cach':38B,164C 'stale':9A,54B,127C,151C 'unauthent':130C 'unconfirm':82B 'url':145C 'user':15A,62B,139C,156C 'valid':76B,95C,116C 'valu':152C 'vulner':77B,96C 'withdrawn':1A,69B,83C,89C 'zero':119C,171C","nicknames":[],"mitigations":[],"who_affected":"The withdrawal means the advisory itself does not establish exposure. Teams using http-cache-semantics in a shared cache that serves responses to multiple users would be the only ones to look at, and only if they cannot confirm the withdrawal reasoning. unknown whether the withdrawal reflects a disproven issue or a duplicate.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-18T18:18:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-ch52-4w7c-c8xp","url":"https://github.com/advisories/GHSA-ch52-4w7c-c8xp","severity":"high","published_at":"2026-09-18T18:31:44+00:00","modified_at":"2026-10-28T21:13:40+00:00","first_seen_at":"2026-10-28T21:17:51+00:00","fetched_at":"2026-10-28T21:17:51+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-93748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93748","severity":null,"published_at":"2026-09-18T18:18:33+00:00","modified_at":"2026-10-14T23:19:08+00:00","first_seen_at":"2026-10-28T21:35:45+00:00","fetched_at":"2026-10-28T21:35:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}