This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-docs | Apr 21, 2023 | Jan 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-libsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade npmUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade v8-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsource | Feb 17, 2025 | Jan 31, 2023 |
| Centos_linux | — | Upgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-docs | Apr 10, 2023 | Jan 31, 2023 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-nodemon | Apr 5, 2023 | Jan 31, 2023 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoNo solution existsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade nodejs-nodemon | Apr 3, 2023 | Jan 31, 2023 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade npm | Mar 5, 2024 | Jan 31, 2023 |
| Simple Local Avatars Plugin | — | Update simple-local-avatars plugin to version 2.7.4, or a newer patched version | May 15, 2025 | Feb 23, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12 | Sep 30, 2025 | Jan 31, 2023 |
| Suse | — | Upgrade nodejs16-develUpgrade corepack14Upgrade npm14Upgrade nodejs14Upgrade nodejs10-docsUpgrade npm10Upgrade nodejs18-develUpgrade nodejs10-develUpgrade nodejs18Upgrade nodejs16Upgrade nodejs14-docsUpgrade nodejs16-docsUpgrade npm16Upgrade nodejs12-develUpgrade nodejs12-docsUpgrade nodejs14-develUpgrade corepack18Upgrade corepack16Upgrade npm18Upgrade nodejs10Upgrade nodejs12Upgrade nodejs18-docsUpgrade npm12 | Apr 18, 2023 | Jan 31, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub