CVE-2026-21713 - Vulnerability Details

Description

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.

Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.

This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

Published: 2026-03-30

Score: 5.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in Node.js validates user‑provided HMAC signatures with a non‑constant‑time comparison, leaking timing information proportional to matching bytes. This side‑channel can be exploited by an attacker with high‑resolution timing measurements to infer the correct HMAC value, potentially compromising authentication or message integrity. The weakness aligns with a timing side‑channel definition.

Affected Systems

Node.js releases 20.x, 22.x, 24.x, and 25.x contain the vulnerable comparison logic and are impacted by this flaw.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. Because no EPSS score or KEV listing is present, the probability of real‑world exploitation remains uncertain, though timing attacks are feasible when an attacker can observe repeated verification requests. The vulnerability does not directly expose secrets, but it can be a stepping‑stone for more destructive attacks if combined with other weaknesses.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

nodejs

node

unaffected

Version	Status	Constraints
`20.20.1`	affected	≤ 20.20.1
`22.22.1`	affected	≤ 22.22.1
`24.14.0`	affected	≤ 24.14.0
`25.8.1`	affected	≤ 25.8.1
`4.0`	affected	< 4.*
`5.0`	affected	< 5.*
`6.0`	affected	< 6.*
`7.0`	affected	< 7.*
`8.0`	affected	< 8.*
`9.0`	affected	< 9.*
`10.0`	affected	< 10.*
`11.0`	affected	< 11.*
`12.0`	affected	< 12.*
`13.0`	affected	< 13.*
`14.0`	affected	< 14.*
`15.0`	affected	< 15.*
`16.0`	affected	< 16.*
`17.0`	affected	< 17.*
`18.0`	affected	< 18.*
`19.0`	affected	< 19.*

No data.

Vendor Product Confidence Versions

Nodejs

92%

Version	Status	Scheme	Platform
`[20.20.1,20.20.1]`	affected	semver	—
`[22.22.1,22.22.1]`	affected	semver	—
`[24.14.0,24.14.0]`	affected	semver	—
`[25.8.1,25.8.1]`	affected	semver	—
`[0,5.0.0)`	affected	semver	—
`[0,6.0.0)`	affected	semver	—
`[0,7.0.0)`	affected	semver	—
`[0,8.0.0)`	affected	semver	—
`[0,9.0.0)`	affected	semver	—
`[0,10.0.0)`	affected	semver	—
`[0,11.0.0)`	affected	semver	—
`[0,12.0.0)`	affected	semver	—
`[0,13.0.0)`	affected	semver	—
`[0,14.0.0)`	affected	semver	—
`[0,15.0.0)`	affected	semver	—
`[0,16.0.0)`	affected	semver	—
`[0,17.0.0)`	affected	semver	—
`[0,18.0.0)`	affected	semver	—
`[0,19.0.0)`	affected	semver	—
`[0,20.0.0)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Node.js to the latest patch release for the affected series, which replaces the insecure comparison with a constant‑time primitive.
If an immediate upgrade is not possible, modify the verification code to use Node.js’s `crypto.timingSafeEqual` function for HMAC comparison.
Validate that the updated Node.js rebuilds the affected modules and passes security tests or scans.
Keep monitoring Node.js security advisories for further updates or guidance.

Generated by OpenCVE AI on March 30, 2026 at 20:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6183-1	nodejs security update

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00011.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://nodejs.org/en/blog/vulnerability/march-2026-security-releases
https://nvd.nist.gov/vuln/detail/CVE-2026-21713
https://www.cve.org/CVERecord?id=CVE-2026-21713

History

Wed, 01 Apr 2026 02:15:00 +0000

Type	Values Removed	Values Added
Title	Timing Side‑Channel in Node.js HMAC Verification	Node.js: Node.js: Information disclosure via timing oracle in HMAC verification
First Time appeared		Nodejs Nodejs nodejs
Weaknesses		CWE-208
Vendors & Products		Nodejs Nodejs nodejs
References		https://nvd.nist.gov/vuln/detail/CVE-2026-21713 https://www.cve.org/CVERecord?id=CVE-2026-21713
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}` threat_severity `Moderate`

Tue, 31 Mar 2026 03:00:00 +0000

Type	Values Removed	Values Added
Title		Timing Side‑Channel in Node.js HMAC Verification
Weaknesses		CWE-203

Mon, 30 Mar 2026 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 30 Mar 2026 19:30:00 +0000

Type	Values Removed	Values Added
Description		A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects 20.x, 22.x, 24.x, and 25.x.
References		https://nodejs.org/en/blog/vulnerability/march-2026-security-releases
Metrics		cvssV3_0 `{'score': 5.9, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Subscriptions

Nodejs Nodejs

MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2026-03-30T19:07:28.356Z

Updated: 2026-03-30T19:45:22.905Z

Reserved: 2026-01-04T15:00:06.574Z

Link: CVE-2026-21713

Vulnrichment

Updated: 2026-03-30T19:45:19.620Z

NVD

Status : Awaiting Analysis

Published: 2026-03-30T20:16:19.397

Modified: 2026-04-01T14:24:21.833

Link: CVE-2026-21713

Redhat

Severity : Moderate

Publid Date: 2026-03-30T19:07:28Z

Links: CVE-2026-21713 - Bugzilla

OpenCVE Enrichment

Updated: 2026-03-31T20:40:26Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object