CVE-2026-93748

47th percentile - higher than 47% of all known CVEs

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.

An attacker can access other users' session data, leading to account takeover and confidentiality breaches. The risk affects shared caches.

Update http-cache-semantics to a version newer than 4.2.0 as soon as it becomes available, and review shared cache configurations for storage of authentication data.