{"schema_version":"2","view":"grouped","data":[{"id":70989,"cve_ids":["CVE-2026-93748"],"payload":{"kind":"advisory","title":"http-cache-semantics max-stale handling can disclose cross-user cached responses","summary":"http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.","evidence":"osv:GHSA-ch52-4w7c-c8xp","products":[{"name":{"value":"http-cache-semantics","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"GHSA-ch52-4w7c-c8xp","aliases":["CVE-2026-93748","GHSA-ch52-4w7c-c8xp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.2.0"}]}],"package":{"name":"http-cache-semantics","purl":"pkg:npm/http-cache-semantics","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-ch52-4w7c-c8xp/GHSA-ch52-4w7c-c8xp.json"}}],"modified":"2026-10-02T22:45:04.334960361Z","provider":"osv","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-93748","https://github.com/kornelski/http-cache-semantics/issues/56","https://github.com/kornelski/http-cache-semantics","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623","https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale"],"provider_metadata":{"cwe_ids":["CWE-524"],"severity":"HIGH","github_reviewed":true,"nvd_published_at":"2026-09-18T18:18:33Z","github_reviewed_at":"2026-10-02T22:36:42Z"}},"related_cves":[{"value":"CVE-2026-93748","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-ch52-4w7c-c8xp","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-93748","metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"http-cache-semantics","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93748","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-ch52-4w7c-c8xp","advisory_id":"4ed0d367-3369-47cc-a017-bdc34fe16d68","event_types":["advisory"],"published_at":"2026-10-25T22:46:11.629331+00:00","technologies":["core-osv","http-cache-semantics"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T18:31:44+00:00","detail_url":"/advisories/osv%3AGHSA-ch52-4w7c-c8xp","group":{"id":"osv:GHSA-ch52-4w7c-c8xp","revision":1,"primary_event_id":71362,"change":"published","superseded_by":[],"changed":{"id":71362,"cve_ids":["CVE-2026-93748"],"payload":{"kind":"advisory","title":"http-cache-semantics max-stale handling can disclose cross-user cached responses","summary":"http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.","evidence":"osv:GHSA-ch52-4w7c-c8xp","products":[{"name":{"value":"http-cache-semantics","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"GHSA-ch52-4w7c-c8xp","aliases":["CVE-2026-93748","GHSA-ch52-4w7c-c8xp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.2.0"}]}],"package":{"name":"http-cache-semantics","purl":"pkg:npm/http-cache-semantics","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-ch52-4w7c-c8xp/GHSA-ch52-4w7c-c8xp.json"}}],"modified":"2026-10-02T22:45:04.334960361Z","provider":"osv","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-93748","https://github.com/kornelski/http-cache-semantics/issues/56","https://github.com/kornelski/http-cache-semantics","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623","https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale"],"provider_metadata":{"cwe_ids":["CWE-524"],"severity":"HIGH","github_reviewed":true,"nvd_published_at":"2026-09-18T18:18:33Z","github_reviewed_at":"2026-10-02T22:36:42Z"}},"related_cves":[{"value":"CVE-2026-93748","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-ch52-4w7c-c8xp","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-93748","metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"http-cache-semantics","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93748","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-ch52-4w7c-c8xp","advisory_id":"4ed0d367-3369-47cc-a017-bdc34fe16d68","event_types":["advisory"],"published_at":"2026-10-25T22:46:11.629331+00:00","technologies":["core-osv","http-cache-semantics"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T18:31:44+00:00","detail_url":"/events/71362"},"members":[{"id":71362,"cve_ids":["CVE-2026-93748"],"payload":{"kind":"advisory","title":"http-cache-semantics max-stale handling can disclose cross-user cached responses","summary":"http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.","evidence":"osv:GHSA-ch52-4w7c-c8xp","products":[{"name":{"value":"http-cache-semantics","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"GHSA-ch52-4w7c-c8xp","aliases":["CVE-2026-93748","GHSA-ch52-4w7c-c8xp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.2.0"}]}],"package":{"name":"http-cache-semantics","purl":"pkg:npm/http-cache-semantics","ecosystem":"npm"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-ch52-4w7c-c8xp/GHSA-ch52-4w7c-c8xp.json"}}],"modified":"2026-10-02T22:45:04.334960361Z","provider":"osv","references":["https://nvd.nist.gov/vuln/detail/CVE-2026-93748","https://github.com/kornelski/http-cache-semantics/issues/56","https://github.com/kornelski/http-cache-semantics","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441","https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623","https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale"],"provider_metadata":{"cwe_ids":["CWE-524"],"severity":"HIGH","github_reviewed":true,"nvd_published_at":"2026-09-18T18:18:33Z","github_reviewed_at":"2026-10-02T22:36:42Z"}},"related_cves":[{"value":"CVE-2026-93748","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-ch52-4w7c-c8xp","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-93748","metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"http-cache-semantics","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93748","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-ch52-4w7c-c8xp","advisory_id":"4ed0d367-3369-47cc-a017-bdc34fe16d68","event_types":["advisory"],"published_at":"2026-10-25T22:46:11.629331+00:00","technologies":["core-osv","http-cache-semantics"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-18T18:31:44+00:00","detail_url":"/events/71362"}]}}],"next_after":70989,"next_before":70989}