{"id":"CVE-2026-93748","title":"http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users","summary":"http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-524"],"vendor":"kornelski","product":"http-cache-semantics","affected":["http-cache-semantics <= 4.2.0"],"published":"2026-09-18","updated":"2026-10-14","sourceUpdated":"2026-10-14T23:19:08.810","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93748","references":[{"url":"https://github.com/kornelski/http-cache-semantics","label":"disclosure@vulncheck.com"},{"url":"https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441","label":"disclosure@vulncheck.com"},{"url":"https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623","label":"disclosure@vulncheck.com"},{"url":"https://github.com/kornelski/http-cache-semantics/issues/56","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale","label":"disclosure@vulncheck.com"},{"url":"https://github.com/kornelski/http-cache-semantics/issues/56#issuecomment-5975759591","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93748.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-93748"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538111"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93748"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93748"},{"url":"https://github.com/advisories/GHSA-ch52-4w7c-c8xp"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"url":"https://access.redhat.com/errata/RHSA-2026:88198"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat","ghsa","npm"],"epss":0.00569,"epssPercentile":0.46947,"aliases":["GHSA-ch52-4w7c-c8xp"],"ecosystem":"npm","exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-14T22:56:33.212079Z"},"ingestedAt":"2026-09-18T18:47:53.268Z","patched":["openshift_ai 3.4"],"slug":"CVE-2026-93748","body":"## Overview\n\nhttp-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-93748)\n\nAffected packages:\n\n- `http-cache-semantics <= 4.2.0`\n\nSource: https://github.com/advisories/GHSA-ch52-4w7c-c8xp\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Multicluster Engine for Kubernetes, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AMQ Broker 7, Red Hat build of Apache Camel - HawtIO 4, Red Hat Connectivity Link 1, … · no fix planned: Red Hat Connectivity Link 1, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93748.json)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)\n- **RHSA-2026:88198** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88198)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":207506,"id":"CVE-2026-93748","ts":1789764763674,"field":"exploit_available","old":"false","new":"true"}]}