Http Cache Semanticsproject Http Cache Semantics
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Http Cache Semanticsproject Http Cache Semantics.
By the Year
In 2026 there have been 2 vulnerabilities in Http Cache Semanticsproject Http Cache Semantics with an average score of 8.5 out of ten. Http Cache Semantics did not have any published security vulnerabilities last year. That is, 2 more vulnerabilities have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2 | 8.45 |
| 2025 | 0 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 1 | 7.50 |
It may take a day or so for new Http Cache Semantics vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Http Cache Semanticsproject Http Cache Semantics Security Vulnerabilities
Cache Validation Flaw in http-cache-semantics v<4.2.1 (Vary Wildcard Mismatch)
CVE-2026-93750
8.2 - High
- September 18, 2026
http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.
Interpretation Conflict
http-cache-semantics 4.2.0 Cache Credential Leakage via maxstale
CVE-2026-93748
8.7 - High
- September 18, 2026
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
Use of Cache Containing Sensitive Information
Header Injection in http-cache-semantics <4.1.1 via Malicious Headers
CVE-2022-25881
7.5 - High
- January 31, 2023
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
ReDoS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Http Cache Semanticsproject Http Cache Semantics or by Http Cache Semanticsproject? Click the Watch button to subscribe.
