This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-docs | Apr 21, 2023 | Jan 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade v8-develUpgrade nodejs-develUpgrade npmUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs | Feb 17, 2025 | Jan 31, 2023 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundler | Apr 10, 2023 | Jan 31, 2023 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-docs | Apr 5, 2023 | Jan 31, 2023 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-nodemonNo solution existsUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade nodejs-libsUpgrade nodejs-devel | Apr 3, 2023 | Jan 31, 2023 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18n | Mar 5, 2024 | Jan 31, 2023 |
| Simple Local Avatars Plugin | — | Update simple-local-avatars plugin to version 2.7.4, or a newer patched version | May 15, 2025 | Feb 23, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.12 | Sep 30, 2025 | Jan 31, 2023 |
| Suse | — | Upgrade nodejs18-develUpgrade nodejs18Upgrade nodejs10-docsUpgrade nodejs16-develUpgrade npm10Upgrade nodejs10-develUpgrade npm16Upgrade corepack14Upgrade npm14Upgrade nodejs16Upgrade nodejs14-docsUpgrade nodejs16-docsUpgrade nodejs14Upgrade nodejs14-develUpgrade nodejs12-docsUpgrade npm12Upgrade nodejs12-develUpgrade corepack16Upgrade npm18Upgrade nodejs10Upgrade nodejs12Upgrade nodejs18-docsUpgrade corepack18 | Apr 18, 2023 | Jan 31, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub