Lack of data validation - Path Traversal In nodejs
Description
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.
Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.21 | 22.22.2-r0 | ||
 debian 12 | 18.20.4+dfsg-1~deb12u2 | ||
debian 13 | 20.19.2+dfsg-1+deb13u2 | ||
debian 14 | 22.22.2+dfsg+~cs22.19.15-1 | ||
alpine v3.22 | 22.22.2-r0 | ||
alpine v3.23 | 24.14.1-r0 | ||
 rpm rhel8 | - | - | |
rpm rhel9 | - | - | |
rpm rhel10 | - | - | |
rpm rhel10 | 1:24.14.1-2.el10_1 |
1-10 of 12
10
Aliases
References