Riskcovery

CVE-2026-21713

State
Published
Severity
5.9 Medium
Published
Mar 30, 2026
Updated
May 10, 2026
Reserved
Jan 4, 2026

Read the record on cve.org

Description

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.

Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.

This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

Scores

CVSSScoreVectorSource
3.05.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nhackerone

Weaknesses

  • CWE-208 Observable Timing Discrepancy

Affected Products

ProductVersions
nodenodejs
  • 20.20.1 through 20.20.1Affected
  • 22.22.1 through 22.22.1Affected
  • 24.14.0 through 24.14.0Affected
  • 25.8.1 through 25.8.1Affected
  • 4.0 to before 4.*Affected
  • 5.0 to before 5.*Affected
  • 6.0 to before 6.*Affected
  • 7.0 to before 7.*Affected
  • 8.0 to before 8.*Affected
  • 9.0 to before 9.*Affected
  • 10.0 to before 10.*Affected
  • 11.0 to before 11.*Affected
  • 12.0 to before 12.*Affected
  • 13.0 to before 13.*Affected
  • 14.0 to before 14.*Affected
  • 15.0 to before 15.*Affected
  • 16.0 to before 16.*Affected
  • 17.0 to before 17.*Affected
  • 18.0 to before 18.*Affected
  • 19.0 to before 19.*Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.