CVE-2026-93748: http-cache-semantics Information Disclosure

CVE-2026-93748 Overview

CVE-2026-93748 is a cross-user cache disclosure vulnerability in the http-cache-semantics Node.js library through version 4.2.0. The library fails to properly validate security-zeroed cache entries when processing client max-stale directives. Unauthenticated attackers can request the same URL with a large max-stale value to retrieve cached responses belonging to other users. The disclosed data can include Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons. The flaw is classified under [CWE-524: Use of Cache Containing Sensitive Information].

Critical Impact
Unauthenticated network attackers can retrieve other users' session cookies and sensitive cached responses from shared caches, enabling account takeover.

Affected Products

http-cache-semantics npm package versions through 4.2.0
Node.js applications and HTTP client libraries that depend on http-cache-semantics for shared caching
Reverse proxies and CDN-like middleware built on top of the affected library

Discovery Timeline

2026-09-18 - CVE-2026-93748 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-93748

Vulnerability Analysis

The http-cache-semantics library implements HTTP caching rules defined in RFC 7234, including handling of the client-supplied Cache-Control: max-stale directive. When a shared cache entry is intentionally zeroed for security reasons, for example to prevent reuse across users, the library does not re-check that state during stale-response evaluation.

An attacker that repeatedly requests the same URL with a large max-stale value causes the library to return the previously stored response despite the security zeroing. Because HTTP responses commonly include Set-Cookie and other per-user headers, the returned data can leak session credentials belonging to a different user. This produces confidentiality loss without any authentication.

Root Cause

The root cause is missing validation of security-invalidated cache state in the freshness and stale-serving logic. The relevant logic in index.js (lines 425-441 and 603-623) evaluates the client max-stale value against response age but does not honor the zeroed marker that indicates the entry must not be reused. The library therefore treats a deliberately invalidated entry as a normal stale entry that max-stale can extend.

Attack Vector

Exploitation requires only network access to an application that uses http-cache-semantics as a shared cache and stores responses containing sensitive headers. The attacker issues an HTTP request to a target URL with a Cache-Control: max-stale=<large-value> header. The library returns the cached response from a previous, unrelated user, exposing Set-Cookie values and any other per-user response data.

The vulnerability mechanism is described in the VulnCheck Security Advisory and the upstream GitHub Issue Discussion. No verified proof-of-concept code is published in the referenced sources, so no exploit code is reproduced here.

Detection Methods for CVE-2026-93748

Indicators of Compromise

Repeated inbound HTTP requests to the same URL that carry unusually large Cache-Control: max-stale values from unauthenticated clients.
Application or proxy logs showing cached responses served to one client that contain Set-Cookie headers issued for a different user session.
Session cookies appearing on IP addresses or user agents that never performed a valid authentication flow.

Detection Strategies

Inspect HTTP request headers at the reverse proxy or WAF for Cache-Control directives containing large max-stale values and correlate with response bodies containing session material.
Perform a software composition analysis (SCA) scan of package.json and package-lock.json files to identify http-cache-semantics versions at or below 4.2.0.
Review cache middleware logs for hits on entries that were previously marked for security invalidation.

Monitoring Recommendations

Alert on anomalous distributions of max-stale header values across clients, especially those exceeding normal application timeouts.
Monitor authentication systems for session reuse across mismatched client fingerprints, which can indicate stolen cookies.
Track dependency drift for http-cache-semantics across build pipelines and container images.

How to Mitigate CVE-2026-93748

Immediate Actions Required

Inventory all Node.js services and their dependency trees to identify direct and transitive use of http-cache-semantics at or below 4.2.0.
Disable shared caching for responses that carry Set-Cookie or other per-user headers until a fixed version is deployed.
Rotate and invalidate active session tokens for any application where a shared cache backed by the vulnerable library may have served cross-user responses.

Patch Information

At the time of publication, refer to the upstream GitHub Project Repository and the GitHub Issue Discussion for the latest fixed release and remediation status. Upgrade to a version above 4.2.0 once the maintainer publishes a patched release that validates security-zeroed cache entries before honoring client max-stale directives.

Workarounds

Configure the caching layer to strip or ignore client-supplied Cache-Control: max-stale directives on shared caches.
Ensure responses containing Set-Cookie, Authorization, or other user-specific headers are marked Cache-Control: private, no-store at the origin.
Segment caches per authenticated user or per session so that a compromised entry cannot be returned to another principal.

bash

# Configuration example: strip client max-stale at the proxy (nginx)
proxy_set_header Cache-Control "";
proxy_hide_header Set-Cookie;
proxy_cache_bypass $http_authorization $cookie_session;
proxy_no_cache $http_authorization $cookie_session;