This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-devel | Apr 21, 2023 | Jan 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade v8-develUpgrade nodejs-libsUpgrade npmUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs | Feb 17, 2025 | Jan 31, 2023 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade npm | Apr 10, 2023 | Jan 31, 2023 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundler | Apr 5, 2023 | Jan 31, 2023 |
| Redhat_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-docsNo solution existsUpgrade nodejsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-develUpgrade nodejs-full-i18n | Apr 3, 2023 | Jan 31, 2023 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-libs | Mar 5, 2024 | Jan 31, 2023 |
| Simple Local Avatars Plugin | — | Update simple-local-avatars plugin to version 2.7.4, or a newer patched version | May 15, 2025 | Feb 23, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Jan 31, 2023 |
| Suse | — | Upgrade npm16Upgrade corepack14Upgrade npm14Upgrade nodejs16-develUpgrade nodejs16-docsUpgrade nodejs14Upgrade nodejs10-docsUpgrade nodejs14-docsUpgrade nodejs10-develUpgrade nodejs18Upgrade nodejs18-develUpgrade npm10Upgrade nodejs16Upgrade nodejs12-docsUpgrade npm18Upgrade npm12Upgrade nodejs12Upgrade nodejs10Upgrade corepack18Upgrade nodejs14-develUpgrade nodejs12-develUpgrade nodejs18-docsUpgrade corepack16 | Apr 18, 2023 | Jan 31, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub