EUVD-2026-17174CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4Description
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.
Analysis
Node.js versions 20.x, 22.x, 24.x, and 25.x use non-constant-time comparison for HMAC signature verification, allowing remote attackers to infer valid HMAC values through timing oracle attacks. The vulnerability leaks information proportional to matching bytes and requires high-resolution timing measurement capability, making exploitation feasible in controlled network conditions. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | needs-triage | - |
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| questing | needs-triage | - |
| upstream | released | 22.22.2+dfsg+~cs22.19.15-1 |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 12.22.12~dfsg-1~deb11u4 | - |
| bullseye (security) | vulnerable | 12.22.12~dfsg-1~deb11u7 | - |
| bookworm, bookworm (security) | vulnerable | 18.20.4+dfsg-1~deb12u1 | - |
| trixie | fixed | 20.19.2+dfsg-1+deb13u2 | - |
| trixie (security) | fixed | 20.19.2+dfsg-1+deb13u2 | - |
| forky | vulnerable | 22.22.1+dfsg+~cs22.19.15-1 | - |
| sid | fixed | 22.22.2+dfsg+~cs22.19.15-1 | - |
| (unstable) | fixed | 22.22.2+dfsg+~cs22.19.15-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today