This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-devel | Apr 21, 2023 | Jan 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-libs-debuginfoUpgrade v8-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfo | Feb 17, 2025 | Jan 31, 2023 |
| Centos_linux | — | Upgrade nodejs-packagingUpgrade npmUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-nodemon | Apr 10, 2023 | Jan 31, 2023 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18n | Apr 5, 2023 | Jan 31, 2023 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoNo solution existsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-devel | Apr 3, 2023 | Jan 31, 2023 |
| Rocky_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18n | Mar 5, 2024 | Jan 31, 2023 |
| Simple Local Avatars Plugin | — | Update simple-local-avatars plugin to version 2.7.4, or a newer patched version | May 15, 2025 | Feb 23, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Jan 31, 2023 |
| Suse | — | Upgrade nodejs10Upgrade corepack16Upgrade npm18Upgrade npm12Upgrade nodejs14-develUpgrade corepack18Upgrade nodejs12-develUpgrade nodejs12Upgrade nodejs18-docsUpgrade nodejs12-docsUpgrade corepack14Upgrade nodejs10-docsUpgrade npm14Upgrade nodejs18-develUpgrade nodejs16Upgrade nodejs16-develUpgrade npm16Upgrade nodejs14Upgrade nodejs10-develUpgrade nodejs18Upgrade nodejs16-docsUpgrade nodejs14-docsUpgrade npm10 | Apr 18, 2023 | Jan 31, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub