Debian/node-got: unknown

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses

Action: No fix published. Pin and monitor.

Affected

introduced	fixed	last affected
0	-	-

Fixed versions

No fixed version in the source.

Sources

osv: DEBIAN-CVE-2026-93748#Debian:14/node-got
https://security-tracker.debian.org/tracker/CVE-2026-93748

published 2026-09-18T18:18:33.330Z · modified 2026-10-15T09:47:37.333952635Z · JSON