2vulnerabilities
- Critical0 (0.0%)
- High2 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
http-cache-semantics
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting http-cache-semantics, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-ch52-4w7c-c8xp | High | Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses### Withdrawn Advisory This advisory has been withdrawn because it's not a valid vulnerability. This link is maintained to preserve external references. ### Original Description http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reaso |
| GitHub (opens in a new tab) | |
| GHSA-rc47-6667-2j5j | High | http-cache-semantics vulnerable to Regular Expression Denial of Servicehttp-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library. |
| GitHub (opens in a new tab) |
- GHSA-ch52-4w7c-c8xpHighWithdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses
<= 4.2.0
### Withdrawn Advisory This advisory has been withdrawn because it's not a valid vulnerability. This link is maintained to preserve external references. ### Original Description http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reaso
CVE: CVE-2026-93748
- GHSA-rc47-6667-2j5jHighhttp-cache-semantics vulnerable to Regular Expression Denial of Service
< 4.1.1
http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CVE: CVE-2022-25881