This vulnerability in Node.js arises from the use of a non-constant-time comparison function when validating user-provided HMAC signatures. Because the comparison duration varies with the number of matching bytes, an attacker capable of precise timing measurements could exploit this behavior to gradually infer the correct HMAC value. The issue affects multiple Node.js versions including 20.x, 22.x, 24.x, and 25.x. Node.js typically uses timing-safe comparison functions in other parts of its codebase, suggesting this is an unintentional flaw. The CVSS score is 5.9 (medium severity), reflecting the network attack vector, high complexity, no privileges required, no user interaction, and confidentiality impact only. No patch or vendor advisory is currently provided.

The vulnerability allows an attacker to potentially leak information about HMAC values through timing side channels, which could compromise the confidentiality of the HMAC. There is no indication of impact on integrity or availability. Exploitation requires the ability to perform high-resolution timing measurements, which may limit practical exploitation scenarios. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be aware of the potential timing leak in HMAC verification and consider mitigating risk by limiting attacker ability to perform precise timing measurements or by applying application-level mitigations. Avoid relying solely on the affected Node.js versions for critical HMAC verification where timing attacks are a concern.