This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-nodemon | Apr 21, 2023 | Jan 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade v8-develUpgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-docs | Feb 17, 2025 | Jan 31, 2023 |
| Centos_linux | — | Upgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18n | Apr 10, 2023 | Jan 31, 2023 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs | Apr 5, 2023 | Jan 31, 2023 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-docsNo solution existsUpgrade nodejs-libs-debuginfo | Apr 3, 2023 | Jan 31, 2023 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade npm | Mar 5, 2024 | Jan 31, 2023 |
| Simple Local Avatars Plugin | — | Update simple-local-avatars plugin to version 2.7.4, or a newer patched version | May 15, 2025 | Feb 23, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.1.1 | Sep 30, 2025 | Jan 31, 2023 |
| Suse | — | Upgrade nodejs10Upgrade nodejs12Upgrade nodejs12-develUpgrade nodejs14-develUpgrade corepack18Upgrade npm18Upgrade corepack16Upgrade npm12Upgrade nodejs12-docsUpgrade nodejs18-docsUpgrade nodejs18-develUpgrade nodejs14Upgrade nodejs16Upgrade nodejs10-docsUpgrade nodejs16-docsUpgrade corepack14Upgrade npm14Upgrade npm10Upgrade nodejs16-develUpgrade nodejs18Upgrade nodejs10-develUpgrade nodejs14-docsUpgrade npm16 | Apr 18, 2023 | Jan 31, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub