EUVD-2026-83253PublishedWithdrawn
http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-93748 · Microsoft / collected KEV context
cve-program · CVE-2026-93748
- https://github.com/kornelski/http-cache-semantics/issues/56
- https://github.com/kornelski/http-cache-semantics
- https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441
- https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623
- https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale
euvd · EUVD-2026-83253
- https://github.com/kornelski/http-cache-semantics/issues/56
- https://github.com/kornelski/http-cache-semantics
- https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441
- https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623
- https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale
nvd · CVE-2026-93748
- https://github.com/kornelski/http-cache-semantics
- https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441
- https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623
- https://github.com/kornelski/http-cache-semantics/issues/56
- https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale
- https://github.com/advisories/GHSA-ch52-4w7c-c8xp
- https://github.com/github/advisory-database/issues/10139
- https://github.com/kornelski/http-cache-semantics/issues/56#issuecomment-5975759591
osv · GHSA-ch52-4w7c-c8xp
- https://nvd.nist.gov/vuln/detail/CVE-2026-93748
- https://github.com/kornelski/http-cache-semantics/issues/56
- https://github.com/kornelski/http-cache-semantics/issues/56#issuecomment-5975759591
- https://github.com/kornelski/http-cache-semantics
- https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441
- https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623
- https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale
Related operational evidence
Explicit CVE identifiers- http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can… · Advisory content revised · 6 Nov 2026
- http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can… · Advisory content revised · 5 Nov 2026
- http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can… · Advisory content revised · 1 Nov 2026
- Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses · Source marks advisory withdrawn · 28 Oct 2026
- Jira Software Data Center: Information Disclosure http-cache-semantics Dependency (CVE-2026-93748) · Security advisory · 20 Oct 2026