CVE-2026-93750

29th percentile - higher than 29% of all known CVEs

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.

The vulnerability enables leakage of sensitive data between users through incorrect Vary header matching, potentially exposing session information or other sensitive content. Organizations using http-cache-semantics in proxy servers or caching applications are exposed to cache poisoning and data leakage attacks.

Update http-cache-semantics to a version newer than 4.2.0 if available, or verify correct Vary header handling in your implementation. Consider additional cache isolation mechanisms between users.