CVE-2026-93750: Kornelski HTTP-Cache-Semantics

Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days.

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.

Affected products

• Kornelski HTTP-Cache-Semantics: up to and including 4.2.0

Published 2026-09-18. Last modified 2026-09-23.