Timing Oracle Vulnerability in Node.js HMAC Verification

CVE-2026-21713

What is CVE-2026-21713?

A security flaw in Node.js relates to its HMAC verification process, where the implementation uses a non-constant-time comparison for validating user signatures. This implementation oversight can lead to the unintended disclosure of timing information linked to matching bytes. In scenarios where attackers can measure execution time with high resolution, they may exploit this behavior as a timing oracle, enabling them to deduce HMAC values. Notably, Node.js includes other timing-safe comparison functions elsewhere in its codebase, suggesting this issue arose from an unintentional mistake in design.

References