Description
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
CVSS breakdown
CVSS 3.0
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- nodejs / node20.20.1 – 20.20.1
- nodejs / node22.22.1 – 22.22.1
- nodejs / node24.14.0 – 24.14.0
- nodejs / node25.8.1 – 25.8.1
- nodejs / node4.0 – 4.*
- nodejs / node5.0 – 5.*
- nodejs / node6.0 – 6.*
- nodejs / node7.0 – 7.*
- nodejs / node8.0 – 8.*
- nodejs / node9.0 – 9.*
- nodejs / node10.0 – 10.*
- nodejs / node11.0 – 11.*
- nodejs / node12.0 – 12.*
- nodejs / node13.0 – 13.*
- nodejs / node14.0 – 14.*
- nodejs / node15.0 – 15.*
- nodejs / node16.0 – 16.*
- nodejs / node17.0 – 17.*
- nodejs / node18.0 – 18.*
- nodejs / node19.0 – 19.*
- nodejs / node.js20.20.1
Updated 5m ago · 8 sources