CVE-2026-93748: http-cache-semantics Max-Stale Handling Vulnerability Leading to Cross-User Cache Disclosure
Summary
CVE-2026-93748: http-cache-semantics max-stale handling can disclose cross-user cached responses. Affects http-cache-semantics versions < 4.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
http-cache-semantics is an npm package that provides a robust implementation of HTTP caching semantics, allowing developers to manage cache behavior in web applications effectively. It supports various cache directives and is widely used in applications that require efficient data retrieval and storage. However, a vulnerability in versions up to 4.2.0 has been identified, which can lead to unauthorized access to cached responses belonging to other users.
Vulnerability Detail
The vulnerability arises from improper validation of security-zeroed cache entries when processing client max-stale directives. This flaw allows unauthenticated attackers to exploit the system by requesting the same URL with a large max-stale value, potentially retrieving another user's Set-Cookie session credentials from shared-cache entries that were intended to be secure. The ramifications of this vulnerability are significant, as it can lead to session hijacking and unauthorized access to user accounts.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional validation checks on the server-side to ensure that cached responses are not served to unauthorized users, although this may not be a complete solution.
Conclusion
The http-cache-semantics package has a critical vulnerability that can lead to cross-user cache disclosure, allowing attackers to access sensitive information. It is crucial for users of this package to update to the latest version to protect their applications from potential exploitation.
See every vulnerability recorded for http-cache-semantics →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions of http-cache-semantics up to and including 4.2.0 are affected by this vulnerability.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The potential consequences include unauthorized access to user sessions and sensitive data, leading to session hijacking and compromised user accounts.
While the best solution is to update to a patched version, implementing additional server-side validation can serve as a temporary mitigation strategy.
Related vulnerabilities
Recent vulnerabilities recorded for http-cache-semantics.
