[Pkg-javascript-devel] Bug#1148405: node-got: CVE-2026-93748

[Salvatore Bonaccorso]

Source: node-got
Version: 11.8.5+~cs58.13.36-8
Severity: important
Tags: security upstream
Forwarded: https://github.com/kornelski/http-cache-semantics/issues/56
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for node-got.

AFAICS, node-got provides the problematic node-http-cache-semantics.
No upstream fix exists yet at time of writing.

CVE-2026-93748[0]:
| http-cache-semantics through 4.2.0 fails to properly validate
| security-zeroed cache entries when processing client max-stale
| directives, allowing unauthenticated attackers to retrieve cached
| responses belonging to other users. Attackers can request the same
| URL with a large max-stale value to obtain another user's Set-Cookie
| session credentials from shared-cache entries that were deliberately
| zeroed for security reasons.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-93748
    https://www.cve.org/CVERecord?id=CVE-2026-93748
[1] https://github.com/kornelski/http-cache-semantics/issues/56

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore