CVE-2026-93750CWE-436

CVE-2026-93750

Medium · published September 18, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
37.7
In the wild
Unconfirmed
What it is

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00445 · 37.7th percentile
Weakness
CWE-436 · Interpretation Conflict
Published
2026-09-18T22:18Z
References (5)
https://github.com/kornelski/http-cache-semantics · [email protected]https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501 · [email protected]https://github.com/kornelski/http-cache-semantics/issues/57 · [email protected]https://www.vulncheck.com/advisories/http-cache-semantics-through-4.2.0-cross-client-cache-disclosure-via-vary-wildcard · [email protected]https://github.com/kornelski/http-cache-semantics/issues/57 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 17:51Z
    http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard
    cvelistv5