Description
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.
Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 rpm rhel10 | | | 1:24.14.1-2.el10_1 |
 alpine v3.21 | | =22.11.0-r0 || =22.11.0-r1 || =22.13.1-r0 || =22.15.1-r0 || >=0 <22.22.2-r0 | 22.22.2-r0 |
 debian 14 | | =20.19.2+dfsg-1 || =20.19.4+dfsg-1 || =20.19.5+dfsg+~cs20.19.12-1 || =20.19.5+dfsg+~cs20.19.12-2 || =20.19.5+dfsg+~cs20.19.12-3 || =20.19.5+dfsg+~cs20.19.12-4 || =20.19.5+dfsg+~cs20.19.24-1 || =22.12.0+dfsg-1 || =22.12.0+dfsg-2 || =22.12.0+dfsg-3 || =22.14.0+dfsg-1 || =22.18.0+dfsg+~cs22.17.2-1 || =22.18.0+dfsg+~cs22.17.2-2 || =22.18.0+dfsg-1 || =22.19.0+dfsg+~cs22.18.0-1 || =22.21.1+dfsg+~cs22.19.0-1 || =22.21.1+dfsg+~cs22.19.0-2 || =22.21.1+dfsg+~cs22.19.0-3 || =22.21.1+dfsg+~cs22.19.0-4 || =22.21.1+dfsg+~cs22.19.0-5 || =22.21.1+dfsg+~cs22.19.0-6 || =22.22.0+dfsg+~cs22.19.13-1 || =22.22.0+dfsg+~cs22.19.13-2 || =22.22.0+dfsg+~cs22.19.6-1 || =22.22.1+dfsg+~cs22.19.15-1 || >=0 <22.22.2+dfsg+~cs22.19.15-1 | 22.22.2+dfsg+~cs22.19.15-1 |
debian 13 | | =20.19.2+dfsg-1 || =20.19.2+dfsg-1+deb13u1 || >=0 <20.19.2+dfsg-1+deb13u2 | 20.19.2+dfsg-1+deb13u2 |
rpm rhel8 | | - | - |
rpm rhel9 | | - | - |
alpine v3.23 | | =22.11.0-r0 || =22.11.0-r1 || =22.11.0-r2 || =22.13.1-r0 || =22.13.1-r1 || =22.13.1-r2 || =22.13.1-r3 || =22.13.1-r4 || =22.13.1-r5 || =22.16.0-r0 || =22.16.0-r1 || =22.16.0-r2 || =22.16.0-r3 || =22.19.0-r3 || =22.19.0-r4 || =22.21.0-r0 || =24.11.1-r0 || =24.13.0-r0 || =24.13.0-r1 || >=0 <24.14.1-r0 | 24.14.1-r0 |
debian 12 | | =18.13.0+dfsg1-1 || =18.13.0+dfsg1-1.1 || =18.19.0+dfsg-1 || =18.19.0+dfsg-2 || =18.19.0+dfsg-3 || =18.19.0+dfsg-4 || =18.19.0+dfsg-5 || =18.19.0+dfsg-6 || =18.19.0+dfsg-6~deb12u1 || =18.19.0+dfsg-6~deb12u2 || =18.19.1+dfsg-1 || =18.19.1+dfsg-2 || =18.19.1+dfsg-3 || =18.19.1+dfsg-3.1 || =18.19.1+dfsg-4 || =18.19.1+dfsg-6 || =18.20.1+dfsg-1 || =18.20.1+dfsg-2 || =18.20.1+dfsg-3 || =18.20.1+dfsg-4 || =18.20.4+dfsg-1~deb12u1 || >=0 <18.20.4+dfsg-1~deb12u2 | 18.20.4+dfsg-1~deb12u2 |
alpine v3.22 | | =22.11.0-r0 || =22.11.0-r1 || =22.11.0-r2 || =22.13.1-r0 || =22.13.1-r1 || =22.13.1-r2 || =22.13.1-r3 || =22.13.1-r4 || =22.13.1-r5 || =22.16.0-r0 || =22.16.0-r1 || =22.16.0-r2 || =22.22.0-r0 || >=0 <22.22.2-r0 | 22.22.2-r0 |
rpm rhel10 | | - | - |
