CVE-2022-25881

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

• CWE-1333
• CWE-1333
• CWE-1333

• https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83Broken Link
• https://security.netapp.com/advisory/ntap-20230622-0008/
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332Exploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783Exploit, Third Party Advisory
• https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83Broken Link
• https://security.netapp.com/advisory/ntap-20230622-0008/
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332Exploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783Exploit, Third Party Advisory

Published

Jan 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25873The package vuetify from 2.0.0-beta.4 and before 2.6.10 are …5.4
• CVE-2022-25875The package svelte before 3.49.0 are vulnerable to Cross-sit…6.1
• CVE-2022-25876The package link-preview-js before 2.1.16 are vulnerable to …5.5
• CVE-2022-25878The package protobufjs before 6.11.3 are vulnerable to Proto…7.5
• CVE-2022-2588It was discovered that the cls_route filter implementation i…7.8
• CVE-2022-25880Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…9.8
• CVE-2022-25882Versions of the package onnx before 1.13.0 are vulnerable to…7.5
• CVE-2022-25883Versions of the package semver before 7.5.2 are vulnerable t…7.5
• CVE-2022-25885The package muhammara before 2.6.0; all versions of package …7.5
• CVE-2022-25887The package sanitize-html before 2.7.1 are vulnerable to Reg…7.5
• CVE-2022-25888The package opcua from 0.0.0 are vulnerable to Denial of Ser…7.5
• CVE-2022-25889Rejected reason: This candidate was in a CNA pool that was n…