Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck
CVE-2026-93748http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale
High 7.5
In plain English
A high-severity security flaw in http-cache-semantics from kornelski. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Official description
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-got | no fix listed | DEBIAN-CVE-2026-93748 |
| Debian:13 | node-got | no fix listed | DEBIAN-CVE-2026-93748 |
| Debian:14 | node-got | no fix listed | DEBIAN-CVE-2026-93748 |
| Ubuntu:22.04:LTS | node-got | no fix listed | UBUNTU-CVE-2026-93748 |
| Ubuntu:24.04:LTS | node-got | no fix listed | UBUNTU-CVE-2026-93748 |
| Ubuntu:26.04:LTS | node-got | no fix listed | UBUNTU-CVE-2026-93748 |
| Ubuntu:26.10 | node-got | no fix listed | UBUNTU-CVE-2026-93748 |
| npm | http-cache-semantics | no fix listed | GHSA-ch52-4w7c-c8xp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kornelski | http-cache-semantics | 0 – through 4.2.0 |
Weakness: CWE-524 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Issue #56 issue-tracking
- https://github.com/kornelski/http-cache-semantics product
- max-stale stale-serving branch that re-serves a zero-lifetime entry technical-description
- maxAge() zeroing for shared Set-Cookie and proxy-revalidate responses technical-description
- VulnCheck Advisory: http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale third-party-advisory
- https://github.com/kornelski/http-cache-semantics/issues/56#issuecomment-5975759591
- https://github.com/advisories/GHSA-ch52-4w7c-c8xp
- https://github.com/github/advisory-database/issues/10139