CVE-2026-93750

Name of the Vulnerable Software and Affected Versions http-cache-semantics versions prior to 4.2.1

Description A cache validation issue exists in the varyMatches() function. The function fails to properly validate Vary header wildcards because it uses byte-for-byte string comparison. This allows attackers to request URLs previously fetched by other clients and receive cached responses intended for different users, leading to the disclosure of sensitive information across clients.

Recommendations Update to version 4.2.1 or later.