CVE-2026-93748Published
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can…
Exact source revision recorded 6 Nov 2026 21:03:40 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-93748 · Microsoft / collected KEV context
nvd · CVE-2026-93748
- https://github.com/kornelski/http-cache-semantics
- https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441
- https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623
- https://github.com/kornelski/http-cache-semantics/issues/56
- https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-user-cache-disclosure-via-max-stale
- https://github.com/advisories/GHSA-ch52-4w7c-c8xp
- https://github.com/github/advisory-database/issues/10139
- https://github.com/kornelski/http-cache-semantics/issues/56#issuecomment-5975759591
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.