CVE-2026-21713

Katalog CVE

CVSS 5.9 · Medium EPSS 0,39%

Kerentanan Observable Timing Discrepancy pada nodejs node.js. Skor CVSS 3.0 5.9 (Medium) menurut hackerone.com.

Deskripsi (NVD)

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

Rincian

Terbit di NVD

30 Maret 2026

Terakhir diubah

19 Agustus 2026

Status NVD

Analyzed

CVSS 3.0

5.9 (Medium), sumber hackerone.com
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-208: Observable Timing Discrepancy

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://nodejs.org/en/blog/vulnerability/march-2026-security-releases advisory vendor