http-cache-semantics@4.3.0

Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies

latest version

4.3.0

first published

10 years ago

latest version published

17 days ago

licenses detected

BSD-2-Clause
>=0

View http-cache-semantics package health on Snyk (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the http-cache-semantics package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Improper Authorization Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons. How to fix Improper Authorization? There is no fixed version for `http-cache-semantics`.	*
H Origin Validation Error Affected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: ` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: ` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure. How to fix Origin Validation Error? There is no fixed version for `http-cache-semantics`.	*

Improper Authorization

Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve cached responses belonging to other users, including Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.

How to fix Improper Authorization?

There is no fixed version for http-cache-semantics.

Origin Validation Error

Affected versions of this package are vulnerable to Origin Validation Error via the _varyMatches() function, which fails to properly handle Vary: * (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The Vary: * directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.

How to fix Origin Validation Error?

There is no fixed version for http-cache-semantics.

Go back to all versions of this package