Skip to content

[GHSA-f27v-pv5m-c5g6] http-cache-semantics through 4.2.0 contains a cache... #10195

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zsharpBDO wants to merge 1 commit into
base: zsharpBDO/advisory-improvement-10195
Choose a base branch
from
Open

[GHSA-f27v-pv5m-c5g6] http-cache-semantics through 4.2.0 contains a cache... #10195

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 27 additions & 7 deletions advisories/unreviewed/2026/09/GHSA-f27v-pv5m-c5g6/GHSA-f27v-pv5m-c5g6.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,23 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f27v-pv5m-c5g6",
"modified": "2026-09-18T18:31:44Z",
"modified": "2026-09-18T18:32:00Z",

@zsharpBDO zsharpBDO Oct 6, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This modified date was automatically generated by the GitHub Advisory form that created this PR. I'm open to making this change, but I think something in the form needs to be updated to ensure the modified date increases correctly.

"published": "2026-09-18T18:31:44Z",
"aliases": [
"CVE-2026-93750"
],
"summary": "http-cache-semantics improperly checks Vary header wildcards",
"details": "http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
Comment on lines 12 to +15

@zsharpBDO zsharpBDO Oct 6, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was also an output of the form. That CVSS:3.1 does seem to line up with the NIST site though, so feel free to make that change. I don't have the permission

],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "http-cache-semantics"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.2.0"
}
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
Expand Down
Loading