This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-docs | Apr 21, 2023 | Jan 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejsUpgrade npmUpgrade nodejs-debugsourceUpgrade v8-develUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfo | Feb 17, 2025 | Jan 31, 2023 |
| Centos_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-packaging | Apr 10, 2023 | Jan 31, 2023 |
| Oracle_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade npmUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18n | Apr 5, 2023 | Jan 31, 2023 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceNo solution existsUpgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade npm | Apr 3, 2023 | Jan 31, 2023 |
| Rocky_linux | — | Upgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-debugsource | Mar 5, 2024 | Jan 31, 2023 |
| Simple Local Avatars Plugin | — | Update simple-local-avatars plugin to version 2.7.4, or a newer patched version | May 15, 2025 | Feb 23, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12 | Sep 30, 2025 | Jan 31, 2023 |
| Suse | — | Upgrade npm18Upgrade nodejs12Upgrade corepack16Upgrade nodejs18-docsUpgrade npm12Upgrade nodejs12-develUpgrade nodejs10Upgrade nodejs14-develUpgrade corepack18Upgrade nodejs12-docsUpgrade nodejs10-docsUpgrade nodejs16-docsUpgrade npm14Upgrade nodejs18-develUpgrade corepack14Upgrade nodejs16Upgrade nodejs14-docsUpgrade npm16Upgrade nodejs10-develUpgrade nodejs18Upgrade npm10Upgrade nodejs16-develUpgrade nodejs14 | Apr 18, 2023 | Jan 31, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub