CVE-2026-93748 in http-cache-semantics
Summary
by MITRE • 09/18/2026
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability in http-cache-semantics versions through 4.2.0 represents a critical failure in cache control logic, specifically concerning the handling of security-zeroed cache entries when processing client-side max-stale directives. This flaw allows unauthenticated attackers to bypass intended security measures and retrieve cached responses that belong to other users. The core issue lies in how the library interprets freshness lifetime constraints for shared caches. When a server returns a response with sensitive data, such as session cookies, it often employs cache control headers like no-store or private directives to prevent caching. However, if these protections are not strictly enforced at the retrieval stage due to flawed logic regarding stale entries, an attacker can exploit this gap by manipulating request parameters.
The technical flaw stems from a misinterpretation of HTTP/1.1 semantics within the library's implementation. Specifically, when a client sends a request with a large max-stale directive, it signals that it is willing to accept responses older than their specified freshness lifetime. In shared cache environments, such as those used by CDNs or reverse proxies, this can lead to the retrieval of entries that were previously zeroed out for security reasons but remain technically accessible if the validation logic fails to check whether the entry was intended to be non-cacheable due to sensitive content. The library incorrectly assumes that a max-stale directive overrides certain cache control restrictions related to user-specific data, leading to the exposure of Set-Cookie headers and other session credentials from previous requests made by different users on the same shared infrastructure.
The operational impact of this vulnerability is severe, as it directly compromises user confidentiality and integrity through session hijacking or credential theft. An attacker who can observe network traffic or control a client's request parameters can send a crafted HTTP GET request with an excessively high max-stale value to a vulnerable proxy server. If the target URL was previously accessed by another authenticated user and cached, even if marked for zeroing due to security policies, the flawed validation logic may still serve that stale entry back to the attacker. This results in the leakage of sensitive session identifiers, which can be used to impersonate legitimate users, access restricted resources, or perform unauthorized actions on behalf of victims.
This vulnerability aligns with CWE-200: Information Exposure and CWE-524: Use of Cache Header That Does Not Comply With Best Practices for Sensitive Data. It also maps to the MITRE ATT&CK technique T1530: Data from Cloud Storage Object, as it involves retrieving data stored in a shared cache layer that was intended to be inaccessible. The attack vector is classified under Network Exploitation and Client-Side Injection, where the attacker manipulates client-side parameters to influence server or proxy behavior.
Mitigation strategies must focus on strict adherence to HTTP caching standards and enhanced validation logic within the application's caching mechanism. Developers should ensure that responses containing sensitive data are explicitly marked with no-store or private directives and verify these flags during cache retrieval operations, regardless of max-stale values. Upgrading http-cache-semantics to a version later than 4.2.0 is essential, as newer versions likely include patches for this validation logic. Additionally, implementing additional security layers such as Content Security Policy headers and ensuring that shared caches do not store user-specific data without proper isolation mechanisms can further reduce the risk of information leakage. Regular audits of cache control implementations against industry standards like RFC 7234 are recommended to prevent similar logical flaws in future deployments.