CVE-2026-93748

npm/http-cache-semantics CVE-2026-93748: high 7.5, EPSS 0.57%

http-cache-semantics max-stale handling can disclose cross-user cached responses

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-ch52-4w7c-c8xp
• https://nvd.nist.gov/vuln/detail/CVE-2026-93748
• https://github.com/kornelski/http-cache-semantics/issues/56
• https://github.com/kornelski/http-cache-semantics
• https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441
• https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623
• https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale

CVE-2026-93748 · published 2026-09-18T18:31:44Z · modified 2026-10-02T22:45:04.334960361Z · JSON