CVE-2026-93750 Overview
CVE-2026-93750 is a cache validation vulnerability in the http-cache-semantics Node.js library through version 4.2.0. The flaw resides in the _varyMatches() function, which performs byte-for-byte string comparison instead of properly handling Vary: * wildcard headers. Attackers can request URLs previously fetched by other clients and receive cached responses that were intended for different users. This results in cross-client information disclosure, potentially exposing session data, authentication tokens, or personalized content across trust boundaries. The vulnerability is tracked under CWE-436: Interpretation Conflict.
Critical Impact
Sensitive per-user HTTP responses cached by intermediaries or clients using http-cache-semantics can be served to unrelated clients, leaking confidential data across sessions.
Affected Products
- http-cache-semantics npm package versions through 4.2.0
- HTTP clients, proxies, and caching layers that embed http-cache-semantics for RFC 7234 cache policy evaluation
- Downstream Node.js applications relying on transitive dependencies such as make-fetch-happen and cacache
Discovery Timeline
- 2026-09-18 - CVE-2026-93750 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-93750
Vulnerability Analysis
The http-cache-semantics library implements HTTP caching rules defined by RFC 7234, including validation of the Vary response header. The Vary header instructs caches that a stored response depends on specific request headers, and a value of * signals that responses must never be reused across requests. The _varyMatches() routine compares stored request headers with new request headers using direct string equality. It does not treat * as a special wildcard indicator that invalidates cache reuse.
When a server returns Vary: *, the library incorrectly matches it as if it were a literal header name. If the header field is absent or identical in a subsequent request, the cached response is deemed valid and returned. This behavior violates the caching contract and enables cache reuse across distinct clients. Sensitive responses tied to authenticated sessions, API tokens, or user-specific content can be served to unrelated requesters, resulting in disclosure of confidential information (see the VulnCheck Security Advisory).
Root Cause
The root cause is improper interpretation of the Vary: * directive within _varyMatches(). The function relies on byte-for-byte string comparison of header names and values without special-casing the wildcard. RFC 7234 requires caches to treat Vary: * as an unconditional signal that stored responses must not be reused. The missing wildcard check produces the interpretation conflict cataloged under CWE-436.
Attack Vector
Exploitation requires an attacker to send network requests to a shared caching layer or client that uses http-cache-semantics. The attacker requests URLs previously fetched by another client. If the origin returned Vary: * on the original response, the library still serves the cached body to the attacker. No authentication is required, and no user interaction is involved. Successful exploitation discloses another client's response data. The vulnerability does not modify data or affect availability. Technical details are documented in the GitHub Code Reference and GitHub Issue #57.
Detection Methods for CVE-2026-93750
Indicators of Compromise
- Repeated requests from unauthenticated clients to URLs that normally require authentication, followed by successful responses served from cache
- Cache hit metrics showing responses returned across distinct session identifiers or client IP addresses for the same URL
- Application logs indicating served responses that do not correspond to the requesting user's session context
Detection Strategies
- Inventory Node.js dependencies with npm ls http-cache-semantics and flag any resolved version at or below 4.2.0
- Perform dynamic testing against caching layers by issuing paired requests with distinct authentication headers and verifying that responses are not reused when Vary: * is present
- Correlate reverse proxy or CDN logs with backend response headers to identify cache decisions that ignore Vary: *
Monitoring Recommendations
- Alert on anomalous cache-hit rates for endpoints that emit Vary: * or Cache-Control: private
- Track outbound response headers from origin services to confirm caching directives are propagated and honored by intermediaries
- Monitor software composition analysis (SCA) findings for transitive updates of http-cache-semantics across build pipelines
How to Mitigate CVE-2026-93750
Immediate Actions Required
- Identify all direct and transitive uses of http-cache-semantics across production, staging, and build environments
- Upgrade to a fixed release of http-cache-semantics once published by the maintainer, tracking progress in GitHub Issue #57
- Audit cached content for endpoints returning user-specific data and purge shared caches that may hold cross-client responses
Patch Information
At the time of NVD publication on 2026-09-18, no fixed version has been formally released. Consumers should monitor the http-cache-semantics GitHub repository and the VulnCheck Security Advisory for a patched release and update all lockfiles once available.
Workarounds
- Configure origin servers to avoid emitting Vary: * on cacheable responses, or set Cache-Control: no-store on responses containing user-specific data
- Disable shared caching for endpoints that return authenticated or personalized content until a patched version is deployed
- Apply a maintained fork or local patch to _varyMatches() that returns false whenever the Vary header contains *
# Configuration example
# Enumerate affected installations across a workspace
npm ls http-cache-semantics
# After a fixed version is published, force update in package.json
npm install http-cache-semantics@latest
npm audit fix --force
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
