CVE-2026-93750: http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard
http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the npm package http-cache-semantics version 4.2.0 or earlier are affected if they use it to validate and serve cached HTTP responses.
What must an attacker do to obtain another client's cached response?
The attacker must request a URL that was previously fetched by another client. Exploitation depends on the cache handling a Vary header wildcard in a way that causes the response to be considered a match.
What is the likely impact if exploitation succeeds?
An attacker can receive a cached response that was intended for a different user or client. The reported impact is disclosure of sensitive information; integrity and availability impacts are not indicated.