Skip to content
OpenAdvisories

Package · Debian

node-got

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.9
    CVE-2026-93750

    http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard

    http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other cl…

    kornelski http-cache-semantics node-got node-got Debian Ubuntu
  • High 7.5
    CVE-2026-93748

    http-cache-semantics through 4.2.0 Cross-User Cache Disclosure via max-stale

    http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same U…

    kornelski http-cache-semantics node-got node-got Debian Ubuntu
  • Medium 5.3
    CVE-2022-33987

    Got allows a redirect to a UNIX socket

    The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

    node-got node-got got Debian Ubuntu npm
  • High 7.5
    CVE-2021-33502

    ReDoS in normalize-url

    The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

    node-yarnpkg node-got node-got normalize-url Debian Ubuntu npm