This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-packaging-bundler | Apr 21, 2023 | Jan 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejsUpgrade npmUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade v8-develUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfo | Feb 17, 2025 | Jan 31, 2023 |
| Centos_linux | — | Upgrade nodejs-packagingUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-libs-debuginfo | Apr 10, 2023 | Jan 31, 2023 |
| Oracle_linux | — | Upgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade npmUpgrade nodejsUpgrade nodejs-packaging-bundler | Apr 5, 2023 | Jan 31, 2023 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-packagingNo solution existsUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-develUpgrade npm | Apr 3, 2023 | Jan 31, 2023 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade npmUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-debuginfo | Mar 5, 2024 | Jan 31, 2023 |
| Simple Local Avatars Plugin | — | Update simple-local-avatars plugin to version 2.7.4, or a newer patched version | May 15, 2025 | Feb 23, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Jan 31, 2023 |
| Suse | — | Upgrade nodejs18-develUpgrade npm10Upgrade nodejs14Upgrade npm14Upgrade nodejs14-docsUpgrade nodejs18Upgrade npm16Upgrade nodejs16-docsUpgrade nodejs10-docsUpgrade nodejs10-develUpgrade corepack14Upgrade nodejs16-develUpgrade nodejs16Upgrade corepack18Upgrade nodejs10Upgrade corepack16Upgrade nodejs14-develUpgrade npm12Upgrade npm18Upgrade nodejs12Upgrade nodejs12-develUpgrade nodejs18-docsUpgrade nodejs12-docs | Apr 18, 2023 | Jan 31, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub