CVE-2026-93750 in http-cache-semantics
Summary
by MITRE • 09/18/2026
http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The http-cache-semantics library version 4.2.0 and earlier contains a critical cache validation vulnerability within the _varyMatches() function that stems from an insufficient handling of HTTP Vary header wildcards. This flaw arises because the implementation relies on byte-for-byte string comparison to determine whether cached responses are suitable for reuse based on request headers, rather than performing semantic or normalized comparisons as required by RFC 7231 and related standards. Specifically, when a server returns a response with a Vary header containing an asterisk wildcard, indicating that the cache key should include all non-simple headers, the library fails to properly invalidate or differentiate cached entries based on this directive. Instead of treating any variation in relevant request headers as invalidating the cache entry for other users, it incorrectly assumes compatibility if the raw byte strings match exactly, bypassing the intended security boundary between different user contexts.
This technical deficiency allows attackers to exploit shared caching mechanisms by requesting URLs that were previously fetched and cached on behalf of another client or user. Because the library does not correctly validate the Vary header wildcards during cache lookup, it may return a stale or misattributed response from the cache store even when the current request contains different headers such as Authorization, Cookie, or Accept-Language values that should have invalidated the previous entry for this specific context. Consequently, an attacker can perform a Cache Poisoning attack where they receive sensitive information intended for other users, including authentication tokens, personal data, or session identifiers. This represents a severe breach of confidentiality and isolation between user sessions in environments utilizing shared HTTP caches such as CDNs, reverse proxies, or browser-level caching mechanisms that rely on this library for validation logic.
The operational impact of this vulnerability is significant in multi-tenant applications and services where user-specific data is served through cached endpoints. Attackers can conduct unauthorized access to private resources by leveraging the misidentified cache entries, effectively bypassing authentication checks if those checks are not re-evaluated upon every request due to reliance on cached responses. This aligns with CWE-200: Information Exposure and CWE-16: Configuration Error, as it reflects a failure in proper configuration of caching rules combined with an implementation error in handling HTTP standards. Furthermore, this vulnerability maps to MITRE ATT&CK technique T1534: Internal Spearphishing if used for lateral movement within internal networks or more broadly to data exfiltration vectors where cached sensitive payloads are harvested by malicious actors without direct exploitation of server-side logic flaws beyond the caching layer itself.
Mitigation strategies must prioritize immediate updates to http-cache-semantics version 4.2.1 or later, which addresses this validation flaw by implementing correct semantic comparison for Vary headers and properly handling wildcard directives according to HTTP specifications. In environments where upgrading is not immediately feasible, administrators should configure web servers and reverse proxies such as Nginx or Apache to disable caching for endpoints that serve user-specific data or require strict isolation between sessions. Additionally, setting Cache-Control: no-store or private directives on responses containing sensitive information can prevent the library from storing these entries in shared caches altogether. Security teams should also audit their application architecture to ensure that critical security decisions are not solely dependent on cached HTTP responses and implement additional server-side validation for session integrity regardless of cache status. Regular penetration testing focusing on caching mechanisms and header manipulation will help identify similar misconfigurations across the infrastructure, ensuring robust protection against cross-user data leakage via compromised or improperly validated caches.