The vulnerability in http-cache-semantics (<=4.2.0) arises from the _varyMatches() function's failure to correctly validate Vary header wildcards. The function uses a strict byte-for-byte string comparison that does not account for wildcard semantics properly. Consequently, an attacker can exploit this by requesting URLs that have been cached for other users, causing the server to return cached responses containing sensitive data meant for different clients. This cache validation flaw can lead to cross-client information disclosure.

Exploitation of this vulnerability can result in unauthorized disclosure of sensitive information across different clients due to improper cache validation. Attackers can receive cached responses intended for other users, violating data confidentiality. The CVSS 4.0 score of 8.2 (high severity) reflects the network attack vector, high complexity, and partial attack prerequisites, with no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating risk by avoiding reliance on vulnerable versions of http-cache-semantics in sensitive environments or implementing additional cache validation controls externally.