High severityNVD Advisory· Published Jan 31, 2023· Updated Mar 27, 2025
CVE-2022-25881
CVE-2022-25881
Description
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
http-cache-semanticsnpm | < 4.1.1 | 4.1.1 |
org.webjars.npm:http-cache-semanticsMaven | < 4.1.1 | 4.1.1 |
Affected products
67- http-cache-semantics/http-cache-semanticsdescription
- osv-coords66 versionspkg:apk/chainguard/nodejs-14pkg:apk/chainguard/pgadmin4pkg:apk/chainguard/pgadmin4-oci-entrypointpkg:apk/chainguard/pgadmin4-pg12pkg:apk/chainguard/pgadmin4-pg13pkg:apk/chainguard/pgadmin4-pg14pkg:apk/chainguard/pgadmin4-pg15pkg:apk/chainguard/pgadmin4-pg16pkg:apk/chainguard/pgadmin4-pg17pkg:maven/org.webjars.npm/http-cache-semanticspkg:npm/http-cache-semanticspkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/npmpkg:rpm/opensuse/nodejs10&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/nodejs12&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/nodejs14&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/nodejs16&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/nodejs18&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/nodejs18&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/nodejs18&distro=openSUSE%20Tumbleweedpkg:rpm/suse/nodejs10&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/nodejs12&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/nodejs12&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/nodejs12&distro=SUSE%20Manager%20Server%204.2pkg:rpm/suse/nodejs14&distro=SUSE%20Enterprise%20Storage%207pkg:rpm/suse/nodejs14&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/nodejs14&distro=SUSE%20Manager%20Server%204.2pkg:rpm/suse/nodejs16&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4pkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/nodejs16&distro=SUSE%20Manager%20Server%204.2pkg:rpm/suse/nodejs18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4pkg:rpm/suse/nodejs18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP5
< 14.21.3-r1+ 65 more
- (no CPE)range: < 14.21.3-r1
- (no CPE)range: < 9.1-r1
- (no CPE)range: < 9.1-r1
- (no CPE)range: < 9.1-r1
- (no CPE)range: < 9.1-r1
- (no CPE)range: < 9.1-r1
- (no CPE)range: < 9.1-r1
- (no CPE)range: < 9.1-r1
- (no CPE)range: < 9.1-r1
- (no CPE)range: < 4.1.1
- (no CPE)range: < 4.1.1
- (no CPE)range: < 1:16.19.1-1.module_el8.7.0+3496+a59a3324
- (no CPE)range: < 1:16.19.1-1.module_el8.7.0+3496+a59a3324
- (no CPE)range: < 1:16.19.1-1.module_el8.7.0+3496+a59a3324
- (no CPE)range: < 1:16.19.1-1.module_el8.7.0+3496+a59a3324
- (no CPE)range: < 1:16.19.1-1.el9_2
- (no CPE)range: < 2.0.20-3.module_el8.7.0+3496+a59a3324
- (no CPE)range: < 25-1.module_el8.5.0+2605+45d748af
- (no CPE)range: < 2021.06-4.module_el8.7.0+3343+ea2b7901
- (no CPE)range: < 1:8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324
- (no CPE)range: < 10.24.1-150000.1.59.1
- (no CPE)range: < 12.22.12-150200.4.47.1
- (no CPE)range: < 14.21.3-150200.15.46.1
- (no CPE)range: < 16.20.0-150400.3.18.2
- (no CPE)range: < 18.16.1-150400.9.9.1
- (no CPE)range: < 18.16.1-150400.9.9.1
- (no CPE)range: < 18.16.0-1.1
- (no CPE)range: < 10.24.1-150000.1.59.1
- (no CPE)range: < 10.24.1-150000.1.59.1
- (no CPE)range: < 10.24.1-150000.1.59.1
- (no CPE)range: < 10.24.1-150000.1.59.1
- (no CPE)range: < 10.24.1-150000.1.59.1
- (no CPE)range: < 10.24.1-150000.1.59.1
- (no CPE)range: < 10.24.1-150000.1.59.1
- (no CPE)range: < 12.22.12-150200.4.47.1
- (no CPE)range: < 12.22.12-150200.4.47.1
- (no CPE)range: < 12.22.12-150200.4.47.1
- (no CPE)range: < 12.22.12-150200.4.47.1
- (no CPE)range: < 12.22.12-150200.4.47.1
- (no CPE)range: < 12.22.12-150200.4.47.1
- (no CPE)range: < 12.22.12-150200.4.47.1
- (no CPE)range: < 12.22.12-150200.4.47.1
- (no CPE)range: < 12.22.12-150200.4.47.1
- (no CPE)range: < 12.22.12-150200.4.47.1
- (no CPE)range: < 14.21.3-150200.15.46.1
- (no CPE)range: < 14.21.3-150200.15.46.1
- (no CPE)range: < 14.21.3-150200.15.46.1
- (no CPE)range: < 14.21.3-150200.15.46.1
- (no CPE)range: < 14.21.3-150200.15.46.1
- (no CPE)range: < 14.21.3-6.43.1
- (no CPE)range: < 14.21.3-150200.15.46.1
- (no CPE)range: < 14.21.3-150200.15.46.1
- (no CPE)range: < 14.21.3-150200.15.46.1
- (no CPE)range: < 14.21.3-150200.15.46.1
- (no CPE)range: < 14.21.3-150200.15.46.1
- (no CPE)range: < 16.20.0-150300.7.21.2
- (no CPE)range: < 16.20.0-150300.7.21.2
- (no CPE)range: < 16.20.0-150300.7.21.2
- (no CPE)range: < 16.20.0-8.27.1
- (no CPE)range: < 16.20.0-150400.3.18.2
- (no CPE)range: < 16.20.0-150300.7.21.2
- (no CPE)range: < 16.20.0-150300.7.21.2
- (no CPE)range: < 16.20.0-150300.7.21.2
- (no CPE)range: < 18.16.1-8.9.1
- (no CPE)range: < 18.16.1-150400.9.9.1
- (no CPE)range: < 18.16.1-150400.9.9.1
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-rc47-6667-2j5jghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-25881ghsaADVISORY
- github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83ghsaWEB
- github.com/kornelski/http-cache-semantics/commit/560b2d8ef452bbba20ffed69dc155d63ac757b74ghsaWEB
- security.netapp.com/advisory/ntap-20230622-0008ghsaWEB
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332ghsaWEB
- security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783ghsaWEB
- security.netapp.com/advisory/ntap-20230622-0008/mitre
News mentions
0No linked articles in our index yet.