The http-cache-semantics library, used under the identifier kornelski/http-cache-semantics, contains a flaw in its _varyMatches() cache validation routine. The code compares Vary header wildcards using a simple byte‑for‑byte match, which fails to differentiate requests that should point to distinct cached items. As a result an attacker can trigger a request that retrieves a cached response previously fetched for a different client, thereby exposing sensitive information that was not intended for the requester's session. This vulnerability is classified as CWE-436 and CWE-524.

Any software component or service that relies on the npm package kornelski/http-cache-semantics up to and including version 4.2.0 incorporates this flaw. The vulnerability is present in the library itself, so all installations of the package in that version range are affected. No information indicates that later releases fixed the issue, so absence of an update cannot be assumed to mitigate the problem.

The CVSS score of 8.2 reflects a high severity vulnerability. In contrast, the EPSS score of less than 1 percent indicates that, as of now, exploitation is considered unlikely, though the potential impact remains significant. The flaw is not listed in CISA’s KEV catalogue. Attackers would need the ability to send HTTP requests to a web service that incorporates this package; by first allowing a legitimate client to create a cache entry and then making a subsequent request, an attacker can receive a cached response intended for that original client.