Vulnerability Description
http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/kornelski/http-cache-semantics
- https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633b
- https://github.com/kornelski/http-cache-semantics/issues/57
- https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-cl
- https://github.com/kornelski/http-cache-semantics/issues/57
FAQ
What is CVE-2026-93750?
CVE-2026-93750 is a vulnerability with a CVSS score of 5.9 (MEDIUM). http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison...
How severe is CVE-2026-93750?
CVE-2026-93750 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93750?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.