This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundler | Apr 21, 2023 | Jan 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-debugsourceUpgrade v8-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs | Feb 17, 2025 | Jan 31, 2023 |
| Centos_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade npm | Apr 10, 2023 | Jan 31, 2023 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs | Apr 5, 2023 | Jan 31, 2023 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceNo solution existsUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade npm | Apr 3, 2023 | Jan 31, 2023 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18n | Mar 5, 2024 | Jan 31, 2023 |
| Simple Local Avatars Plugin | — | Update simple-local-avatars plugin to version 2.7.4, or a newer patched version | May 15, 2025 | Feb 23, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Jan 31, 2023 |
| Suse | — | Upgrade nodejs16Upgrade npm16Upgrade corepack14Upgrade nodejs14-docsUpgrade npm10Upgrade npm14Upgrade nodejs18-develUpgrade nodejs10-docsUpgrade nodejs14Upgrade nodejs16-develUpgrade nodejs10-develUpgrade nodejs18Upgrade nodejs16-docsUpgrade nodejs12-develUpgrade npm18Upgrade npm12Upgrade nodejs12-docsUpgrade nodejs18-docsUpgrade corepack16Upgrade nodejs12Upgrade nodejs10Upgrade nodejs14-develUpgrade corepack18 | Apr 18, 2023 | Jan 31, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub