{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.2.0"}],"component":"http-cache-semantics","cve_ids":["CVE-2026-93748"],"ecosystem":"npm","epss":0.00569,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-ch52-4w7c-c8xp","id":"tcs_01M5KFJSCXBB6X2JMSPC57W5JG","modified_at":"2026-10-02T22:45:04.334960361Z","published_at":"2026-09-18T18:31:44Z","references":["https://osv.dev/vulnerability/GHSA-ch52-4w7c-c8xp","https://nvd.nist.gov/vuln/detail/CVE-2026-93748","https://github.com/kornelski/http-cache-semantics/issues/56","https://github.com/kornelski/http-cache-semantics","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623","https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-ch52-4w7c-c8xp","url":"https://osv.dev/vulnerability/GHSA-ch52-4w7c-c8xp"}],"summary":"http-cache-semantics max-stale handling can disclose cross-user cached responses"}