CVE-2026-93748

About vulnerability

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user’s Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.

Affected product:

AngularJS , Express , Node.js , React , Vue , adk-js , aegir , ai-sdk-angular , ai-sdk-assemblyai , ai-sdk-cerebras , ai-sdk-deepgram , ai-sdk-deepinfra , ai-sdk-deepseek , ai-sdk-elevenlabs , ai-sdk-fal , ai-sdk-gateway , ai-sdk-gladia , ai-sdk-harness , ai-sdk-harness-codex , ai-sdk-harness-deepagents , ai-sdk-harness-opencode , ai-sdk-harness-pi , ai-sdk-hume , ai-sdk-langchain , ai-sdk-llamaindex , ai-sdk-lmnt , ai-sdk-luma , ai-sdk-otel , ai-sdk-policy-opa , ai-sdk-replicate , ai-sdk-revai , ai-sdk-rsc , ai-sdk-sandbox-just-bash , ai-sdk-sandbox-vercel , ai-sdk-togetherai , ai-sdk-valibot , ai-sdk-vercel , ai-sdk-workflow , ai-sdk-workflow-harness , angular-create , angular-eslint-builder , angular-pwa , apollo-datasource-rest , apollo-gateway , apollo-server-plugin-operation-registry , aptos-core , aptos-labs-wallet-adapter-core , aptos-ts-sdk , arcjet-js , arcjet-logger , arcjet-skills , astro , astro-expressive-code , astrojs-cloudflare , astrojs-internal-helpers , astrojs-markdoc , astrojs-markdown-remark , astrojs-mdx , astrojs-netlify , astrojs-node , astrojs-preact , astrojs-prism , astrojs-solid-js , astrojs-starlight , astrojs-studio , astrojs-svelte , astrojs-tailwind , astrojs-underscore-redirects , astrojs-upgrade , astrojs-vercel , astrojs-vue , aws-cdk , babel-plugin-remove-graphql-queries , babel-preset-gatsby , berry , bin-wrapper , bundle-stats , cacheable-request , celo-celocli , celo-connect , celo-contractkit , celo-dev-utils , celo-encrypted-backup , celo-explorer , celo-governance , celo-identity , celo-keystores , celo-phone-number-privacy-common , celo-utils , celo-wallet-base , celo-wallet-hsm , celo-wallet-hsm-azure , celo-wallet-hsm-gcp , celo-wallet-ledger , celo-wallet-local , celo-wallet-remote , celo-wallet-rpc , chain-jslib , chialab-es-dev-server , chialab-es-test-runner , chialab-esbuild-plugin-any-file , chialab-esbuild-plugin-env , chialab-esbuild-plugin-postcss , chialab-node-resolve , chialab-postcss-dart-sass , chialab-rna , chialab-rna-browser-test-runner , chialab-rna-config-loader , chialab-rna-dev-server , chialab-rna-logger , chialab-rna-node-test-runner , chialab-rna-saucelabs-test-runner , chialab-wds-plugin-hmr , chialab-wds-plugin-legacy , chialab-wds-plugin-node-resolve , chialab-wds-plugin-polyfill , chialab-wds-plugin-rna , chialab-wtr-coverage-reporter , chialab-wtr-mocha-reporter , clerk-astro , commit-analyzer , create-expo-module , create-zephyr-apps , cwebp-bin , deps-resolver , developer-tooling , docsearch , docusaurus , docusaurus-core , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-preset-classic , docusaurus-search-local , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , dotansimha-graphql-yoga , download , duckdb-node , electron , elements , epub-iconv , epub-iconv-segment , epub-maker2 , expect-webdriverio , expo , expo-dev-tools , expo-expo-cli , expo-image , expo-modules-core , expo-standard-web-crypto , expo-status-bar , fetchache , gateway , gatsby , gatsby-cli , gatsby-core-utils , gatsby-cypress , gatsby-interface , gatsby-link , gatsby-page-utils , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sharp , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , get , gh-got , github , google-adk , got , got-cjs , got-scraping , graphql-hive-cli , graphql-hive-envelop , graphql-hive-gateway , graphql-mesh , graphql-mesh-cache-cfw-kv , graphql-mesh-cache-localforage , graphql-mesh-cache-redis , graphql-mesh-http , graphql-mesh-merger-stitching , graphql-mesh-mysql , graphql-mesh-odata , graphql-mesh-plugin-hive , graphql-mesh-plugin-http-cache , graphql-mesh-plugin-mock , graphql-mesh-plugin-rate-limit , graphql-mesh-runtime , graphql-mesh-thrift , graphql-mesh-transform-cache , graphql-mesh-transform-hoist-field , graphql-mesh-transform-naming-convention , graphql-mesh-transform-prefix , graphql-mesh-transform-rate-limit , graphql-mesh-transform-rename , graphql-mesh-transform-replace-field , graphql-mesh-transport-mysql , graphql-mesh-transport-sqlite , graphql-mesh-transport-thrift , graphql-mesh-tuql , graphql-mesh-urql-exchange , graphql-yoga , graphql-yoga-apollo-link , graphql-yoga-nestjs , graphql-yoga-nestjs-federation , graphql-yoga-plugin-apq , graphql-yoga-plugin-graphql-sse , graphql-yoga-plugin-sofa , hooks , http-cache-semantics , imagemin-jpegtran , imagemin-mozjpeg , imagemin-optipng , imagemin-pngquant , imagemin-webp , is-online , is-reachable , jest-expo-enzyme , jpegtran-bin , kesla/download-tarball , kevva/download , latest-version , lazy-node-semver-ampersand , ledger-live , ledgerhq-coin-algorand , ledgerhq-coin-aptos , ledgerhq-coin-celo , ledgerhq-coin-concordium , ledgerhq-coin-cosmos , ledgerhq-coin-framework , ledgerhq-coin-tester , ledgerhq-concordium-core , ledgerhq-domain-service , ledgerhq-hw-app-near , ledgerhq-hw-app-tezos , ledgerhq-hw-transport , ledgerhq-hw-transport-mocker , ledgerhq-hw-transport-node-hid-noevents , ledgerhq-hw-transport-node-speculos , ledgerhq-hw-transport-web-ble , ledgerhq-hw-transport-webusb , ledgerhq-live-cli , ledgerhq-live-common , ledgerhq-live-countervalues , ledgerhq-live-currency-format , ledgerhq-live-nft , ledgerhq-live-nft-react , ledgerjs , lerna , lerna-conventional-commits , libcipm , libnpm , libnpmdiff , libnpmexec , libnpmfund , libnpmorg , libnpmversion , libp2p-interface-compliance-tests , libp2p-interfaces-compliance-tests , libp2p-interop , lighthouse , lucide , lucide-astro , lucide-icons , lucide-preact , lucide-react-native , lucide-solid , lucide-static , lucide-svelte , lucide-vue , magic-js , make-fetch-happen , mdx , metamask-core , metamask-snaps-jest , microsoft-rush , microsoft-rush-lib , mikro-orm , mikro-orm-cli , mikro-orm-core , mikro-orm-entity-generator , mikro-orm-libsql , mikro-orm-mariadb , mikro-orm-migrations , mikro-orm-migrations-mongodb , mikro-orm-mssql , mikro-orm-mysql , mikro-orm-postgresql , mikro-orm-reflection , mikro-orm-seeder , mikro-orm-sqlite , mongodb-js-monorepo-tools , mongodb-js-sbom-tools , mongodb-js-shell-bson-parser , mozjpeg-bin , mux-mux-player-react , netlify-build , noble , novel-epub , novel-txt-merge , npm , npm-check , npm-check-updates , npm-init2 , npm-keyword , npm-lifecycle , npm-package-json-loader , npm-profile , npm-registry-fetch , npm:@aptos-labs/aptos-client , npm:@pnpm/exec.lifecycle , npm:@pnpm/exec.prepare-package , npm:gatsby-theme-blog-core , npm:libnpmpack , npmcli-arborist , npmcli-metavuln-calculator , oclif-plugin-plugins , octanejs-astro , octanejs-docusaurus , omnigraph-mysql , omnigraph-thrift , optipng-bin , orama-orama , pack-n-play , package-json , pacote , panda , pandacss-mcp , pandacss-types , percy-cli , percy-cli-app , percy-cli-build , percy-cli-command , percy-cli-config , percy-cli-doctor , percy-cli-exec , percy-cli-snapshot , percy-cli-upload , percy-core , percy-webdriverio , pkgjs-nv , pkgs , plugin-update , pngquant-bin , pnpm , pnpm-building.after-install , pnpm-cache.commands , pnpm-cli.commands , pnpm-cli.parse-cli-args , pnpm-config.parse-overrides , pnpm-config.pick-registry-for-package , pnpm-deps.graph-sequencer , pnpm-deps.inspection.list , pnpm-deps.inspection.tree-builder , pnpm-deps.status , pnpm-fetching.directory-fetcher , pnpm-fetching.git-fetcher , pnpm-fetching.pick-fetcher , pnpm-fetching.tarball-fetcher , pnpm-installing.client , pnpm-installing.context , pnpm-installing.dedupe.check , pnpm-installing.package-requester , pnpm-installing.read-projects-context , pnpm-lockfile.preferred-versions , pnpm-lockfile.settings-checker , pnpm-lockfile.to-pnp , pnpm-lockfile.types , pnpm-lockfile.verification , pnpm-resolving.registry.types , pnpm-resolving.tarball-resolver , pnpm-store.commands , pnpm-store.controller , pnpm-store.controller-types , pnpm-store.index , pnpm-workspace.commands , pnpm-workspace.project-manifest-reader , prettyhtml , public-ip , rehype-expressive-code , release-notes-generator , releaser-tools , remix , remix-run-server-runtime , rna , rollup-plugin-zephyr , run-script , rushstack , rushstack-lockfile-explorer , rushstack-rush-amazon-s3-build-cache-plugin , rushstack-rush-azure-storage-build-cache-plugin , rushstack-rush-serve-plugin , sb , scalar-astro , scalar-starlight , sdk-typescript , selenium-standalone , semantic-release , semantic-release-changelog , semantic-release-git , semantic-release-monorepo , semantic-release-npm , semantic-release-plugin-decorators , sentry-astro , sentry-deno , sentry-effect , sentry-elysia , sentry-ember , sentry-eslint-config-sdk , sentry-eslint-plugin-sdk , sentry-gatsby , sentry-google-cloud-serverless , sentry-hono , sentry-javascript , sentry-nitro , sentry-node-native , sentry-replay , sentry-server-runtime-injection , sentry-server-utils , sentry-solid , sentry-solidstart , sentry-tanstackstart , sentry-tanstackstart-react , sentry-wasm , services , sigstore-cli , sigstore-js , sigstore-oci , sort-package-json3 , sqlite3 , storybook , storybook-addon-a11y , storybook-addon-docs , storybook-addon-links , storybook-angular , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-ember , storybook-preact , storybook-react , storybook-server , storybook-vue3 , storybook-web-components , swarm-js , sync-lockfile , temporalio-worker , theme-ui , thrift-server , transloadit , transloadit-mcp-server , tuf-js , tufjs-cli , unleash-client , up-require , update-notifier , uppy-companion , vercel , vercel-remix-builder , verdaccio , verdaccio-audit , verdaccio-auth , verdaccio-loaders , verdaccio-logger , verdaccio-signature , verdaccio-ui-theme , verdaccio-utils , vite-plugin-tanstack-start-zephyr , vite-plugin-vinext-zephyr , vite-plugin-zephyr , volar-service-json , volar-service-pug , volar-service-pug-beautify , wdio-allure-reporter , wdio-appium-service , wdio-browser-runner , wdio-browserstack-service , wdio-cli , wdio-concise-reporter , wdio-config , wdio-cucumber-framework , wdio-dot-reporter , wdio-firefox-profile-service , wdio-globals , wdio-jasmine-framework , wdio-json-reporter , wdio-junit-reporter , wdio-lighthouse-service , wdio-local-runner , wdio-mocha-framework , wdio-repl , wdio-reporter , wdio-runner , wdio-sauce-service , wdio-shared-store-service , wdio-smoke-test-reporter , wdio-spec-reporter , wdio-static-server-service , wdio-sumologic-reporter , wdio-testingbot-service , wdio-types , wdio-utils , wdio-webdriver-mock-service , web-dev-server-hmr , web-dev-server-rollup , web-test-runner-browserstack , web-test-runner-commands , web-test-runner-coverage-v8 , web-test-runner-junit-reporter , web-test-runner-mocha , web-test-runner-saucelabs , web-test-runner-selenium , web-test-runner-visual-regression , web-test-runner-webdriver , web3 , web3-bzz , web3-core , web3-core-helpers , web3-core-method , web3-core-promievent , web3-core-requestmanager , web3-core-subscriptions , web3-eth , web3-eth-accounts , web3-eth-contract , web3-eth-ens , web3-eth-iban , web3-eth-personal , web3-net , web3-providers-http , web3-providers-ipc , web3-providers-ws , web3-shh , web3-utils , web3.js , webdriver , webdriverio , webpack-cli-generators , with-zephyr , wordpress-env , workflow , workflow-ai , workflow-astro , workflow-builders , workflow-cli , workflow-core , workflow-nest , workflow-next , workflow-nuxt , workflow-rollup , workflow-sveltekit , workflow-swc-plugin , workflow-utils , workflow-vite , workflow-vitest , workflow-web , workflow-web-shared , workflow-world , workflow-world-testing , workflow-world-vercel , ws-pkg-list , ws-segment , ws-yarn-workspaces , x402 , x402-aptos , x402-evm , x402-express , x402-extensions , x402-fastify , x402-hono , x402-mcp , x402-next , x402-paywall , xdl , xdm , xhmikosr-bin-wrapper , yarn-list-link , yarn-tool-changelog , yarn-tool-detect-yarnlock-version , yarn-tool-dotenv , yarn-tool-find-deps , yarn-tool-fix-all , yarn-tool-fix-ws-links , yarn-tool-fix-ws-versions , yarn-tool-get-pkg-bin , yarn-tool-init-path , yarn-tool-is-published , yarn-tool-ncu , yarn-tool-node-modules , yarn-tool-node-modules-is-alias , yarn-tool-node-modules-link , yarn-tool-normalize-deps-value , yarn-tool-npa-to-deps , yarn-tool-npa-to-deps-query , yarn-tool-npm-package-arg-util , yarn-tool-pack-package , yarn-tool-pkg-deps-add , yarn-tool-pkg-deps-util , yarn-tool-pkg-entry-util , yarn-tool-pkg-hosted-info , yarn-tool-pkg-list-to-types , yarn-tool-pkg-name-to-types , yarn-tool-pkg-version-query , yarn-tool-publish-retry , yarn-tool-resolve-package , yarn-tool-run-script-lifecycle , yarn-tool-search-workspace-prefix-by-name , yarn-tool-sort-lerna-json , yarn-tool-sort-package-json-order , yarn-tool-workspaces-project , yarn-tool-ws-changed , yarn-tool-ws-scope , yarn-tool-yarn-struct-utils , yarn-tool-yarnlock , yarn-tool-yarnlock-entries , yarn-tool-yarnlock-fs , yarn-tool-yarnlock-parse , yarn-tool-yarnlock-parse-raw , yarn-tool-yarnlock-types , yarn-tool-yarnlock-util , yarnpkg-cli , yarnpkg-core , yarnpkg-extensions , yarnpkg-nm , yarnpkg-plugin-compat , yarnpkg-plugin-constraints , yarnpkg-plugin-dlx , yarnpkg-plugin-essentials , yarnpkg-plugin-file , yarnpkg-plugin-github , yarnpkg-plugin-interactive-tools , yarnpkg-plugin-link , yarnpkg-plugin-npm-cli , yarnpkg-plugin-pnp , yarnpkg-plugin-pnpm , yarnpkg-plugin-workspace-tools , yarnpkg-pnpify , yarnpkg-sdks , yeoman-generator , yeoman/environment , zbsearch , zbsearch-docs-index , zbsearch-edge-core , zbsearch-edge-index-builder , zbsearch-highlight , zbsearch-plugin-data-persistence , zbsearch-plugin-docusaurus , zbsearch-plugin-embeddings , zbsearch-plugin-match-highlight , zbsearch-plugin-parsedoc , zbsearch-plugin-pt15 , zbsearch-plugin-qps , zbsearch-plugin-starlight , zbsearch-plugin-vitepress , zbsearch-runtime-cloudflare , zbsearch-searchbox-core , zbsearch-searchbox-react , zbsearch-searchbox-vue , zbsearch-static , zbsearch-stemmers , zbsearch-stopwords , zbsearch-tokenizers , zephyr-agent , zephyr-astro-integration , zephyr-edge-contract , zephyr-metro-plugin , zephyr-modernjs-plugin , zephyr-native-cache , zephyr-nuxt-module , zephyr-packages , zephyr-repack-plugin , zephyr-rolldown-plugin , zephyr-rsbuild-plugin , zephyr-rspack-plugin , zephyr-rspress-plugin , zephyr-tap-runtime , zephyr-webpack-plugin , zephyr-xpack-internal

Affected packages:

kornelski_http-cache-semantics @ 3.8.1 (+6294 more)