Http Cache Semantics
Monthly
Cross-client information disclosure in http-cache-semantics through 4.2.0 allows remote, unauthenticated attackers to receive cached responses that were generated for other users. The library's _varyMatches() function performs byte-for-byte comparison of Vary header values and therefore fails to treat a wildcard 'Vary: *' directive as a prohibition on shared-cache reuse, so a request for a URL previously fetched by someone else can be satisfied from cache with that other client's sensitive per-user data. Exploitation is conditional and non-deterministic - it requires a shared, multi-user cache deployment and an origin that emits wildcard Vary on cacheable responses - which is consistent with the vendor CVSS 4.0 score of 8.2 with AC:H and AT:P; no public exploit code has been identified at time of analysis.
Cross-user information disclosure in the http-cache-semantics npm library (through 4.2.0) allows unauthenticated attackers to retrieve cached HTTP responses belonging to other users from a shared cache. By re-requesting an identical URL with a large client-supplied Cache-Control: max-stale directive, an attacker can cause the library to serve cache entries that were deliberately security-zeroed - such as responses carrying Set-Cookie session credentials - instead of suppressing them. The vendor CVSS 4.0 score is 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H), while the independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting that real-world exploitation depends on a downstream shared-cache configuration that stores authenticated responses; the vendor advisory is available from VulnCheck. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Cross-client information disclosure in http-cache-semantics through 4.2.0 allows remote, unauthenticated attackers to receive cached responses that were generated for other users. The library's _varyMatches() function performs byte-for-byte comparison of Vary header values and therefore fails to treat a wildcard 'Vary: *' directive as a prohibition on shared-cache reuse, so a request for a URL previously fetched by someone else can be satisfied from cache with that other client's sensitive per-user data. Exploitation is conditional and non-deterministic - it requires a shared, multi-user cache deployment and an origin that emits wildcard Vary on cacheable responses - which is consistent with the vendor CVSS 4.0 score of 8.2 with AC:H and AT:P; no public exploit code has been identified at time of analysis.
Cross-user information disclosure in the http-cache-semantics npm library (through 4.2.0) allows unauthenticated attackers to retrieve cached HTTP responses belonging to other users from a shared cache. By re-requesting an identical URL with a large client-supplied Cache-Control: max-stale directive, an attacker can cause the library to serve cache entries that were deliberately security-zeroed - such as responses carrying Set-Cookie session credentials - instead of suppressing them. The vendor CVSS 4.0 score is 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H), while the independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting that real-world exploitation depends on a downstream shared-cache configuration that stores authenticated responses; the vendor advisory is available from VulnCheck. No public exploit code and no confirmed active exploitation were identified at time of analysis.