CVE-2026-93750 — http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard
http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for…
Published: 2026-09-18 · CVSS: 8.2 · CVSS 4.0
http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7