CVE-2026-93748: http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using http-cache-semantics through 4.2.0 in a shared-cache context are exposed if cached responses for different users can be served for the same URL. The impact described involves disclosure of another user's Set-Cookie session credentials from security-zeroed shared-cache entries.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction. They can request the same URL with a large max-stale directive in an attempt to retrieve another user's cached response.
Is confidentiality, integrity, or availability affected?
The supplied severity vector indicates high confidentiality impact, with no integrity or availability impact. The disclosed data may include Set-Cookie session credentials belonging to another user.