CVE-2022-25881

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Affected

http-cache-semantics · org.webjars.npm:http-cache-semantics

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 SNYK

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

1.61% chance of exploitation in the next 30 days, 76th percentile

Published

2023-01-31

Updated

2025-03-27

Proof-of-concept exploits (2)

• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
• https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783

Security advisories

• advisories/GHSA-rc47-6667-2j5j

References

• CVE Record
• NVD entry