npm http-cache-semantics vulnerabilities

Latest npm http-cache-semantics CVEs

Newest publication first

1. CVE-2026-93750 http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard

   Published 2026-09-18

   High·CVSS 8.2 EPSS 0.45%

   http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cach...

2. CVE-2026-93748 http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale

   Published 2026-09-18

   High·CVSS 8.7 EPSS 0.60%

   http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-s...

3. CVE-2022-25881 http-cache-semantics vulnerable to Regular Expression Denial of Service

   Published 2023-01-31

   High·CVSS 7.5 EPSS 1.7%

   This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.