Security Flaw in Node-Got: Unauthorized Access to Cached User Data
Summary
DEBIAN-CVE-2026-93748: http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other... Affects node-got versions 11.8.5+~cs58.13.36-3 – 11.8.5+~cs58.13.36-8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-Got is a popular HTTP request library for Node.js, designed to simplify the process of making HTTP requests. It provides a user-friendly API and supports features like promises and streams. However, a vulnerability has been identified in the http-cache-semantics package, which Node-Got relies on, affecting its ability to securely manage cached responses.
Vulnerability Detail
The vulnerability, identified as CVE-2026-93748, arises from the failure of http-cache-semantics (up to version 4.2.0) to properly validate security-zeroed cache entries when processing client max-stale directives. This flaw allows unauthenticated attackers to exploit the caching mechanism to retrieve cached responses that belong to other users. By sending requests with a large max-stale value, attackers can access another user's Set-Cookie session credentials from shared-cache entries that were intended to be secure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable caching in your application by setting the cache option to false when making requests with Node-Got. For example:
const got = require('got');
(async () => {
const response = await got('https://example.com', { cache: false });
console.log(response.body);
})();
This will prevent the application from caching responses, thereby mitigating the risk until the package is updated.
Conclusion
The CVE-2026-93748 vulnerability in Node-Got poses a significant risk by allowing unauthorized access to cached user data. It is crucial to update the package to the latest version to mitigate this risk. Additionally, using workarounds such as disabling caching can provide temporary relief until the update is applied.
See every vulnerability recorded for node-got →
FAQ
CVE-2026-93748 is a security vulnerability in the http-cache-semantics package used by Node-Got, allowing unauthorized access to cached user data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main risk is that attackers can retrieve sensitive session credentials from cached responses, potentially leading to unauthorized access to user accounts.
Yes, updating to the latest version of Node-Got will include the patch for CVE-2026-93748.
If immediate updates are not possible, consider disabling caching in your application as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-got.
