This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-packaging-bundler | Apr 21, 2023 | Jan 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-develUpgrade nodejs-libsUpgrade npmUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade v8-develUpgrade nodejs-debuginfo | Feb 17, 2025 | Jan 31, 2023 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-nodemon | Apr 10, 2023 | Jan 31, 2023 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejsUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-packaging-bundler | Apr 5, 2023 | Jan 31, 2023 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceNo solution existsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade npmUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-devel | Apr 3, 2023 | Jan 31, 2023 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade npm | Mar 5, 2024 | Jan 31, 2023 |
| Simple Local Avatars Plugin | — | Update simple-local-avatars plugin to version 2.7.4, or a newer patched version | May 15, 2025 | Feb 23, 2023 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 9.0.6 | Sep 30, 2025 | Jan 31, 2023 |
| Suse | — | Upgrade npm10Upgrade corepack14Upgrade nodejs16-develUpgrade npm16Upgrade nodejs14Upgrade nodejs16-docsUpgrade npm14Upgrade nodejs10-develUpgrade nodejs16Upgrade nodejs18-develUpgrade nodejs18Upgrade nodejs14-docsUpgrade nodejs10-docsUpgrade nodejs10Upgrade npm18Upgrade corepack18Upgrade nodejs14-develUpgrade nodejs12-docsUpgrade nodejs12-develUpgrade nodejs12Upgrade nodejs18-docsUpgrade corepack16Upgrade npm12 | Apr 18, 2023 | Jan 31, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub