Threats tagged 'bit-node-2026-21713'

Node.js contains a vulnerability in its HMAC verification process where a non-constant-time comparison is used to validate user-provided signatures. This flaw can leak timing information proportional to the number of matching bytes, potentially allowing an attacker with high-resolution timing capabilities to infer HMAC values. The issue affects multiple Node.js versions across 20.x, 21.x, 22.x, 23.x, 24.x, and 25.x branches. A patch is available to address this vulnerability.