AZL-103448
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103448.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-103448
- Upstream
- CVE-2026-93748
- Published
- 2026-09-18T18:18:33Z
- Modified
- 2026-10-01T05:30:55Z
- Summary
- CVE-2026-93748 affecting package nodejs-nodemon 2.0.3-5
- Details
-
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.
- References