Threats affecting pkg:npm/http-cache-semantics

A vulnerability in http-cache-semantics up to version 4.2.0 allows unauthenticated attackers to retrieve cached responses containing sensitive information from other users. This occurs because the software fails to properly validate security-zeroed cache entries when processing client max-stale directives. Attackers can exploit this by requesting the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared cache entries.