CVE-2022-31142: fastify bearer-auth Observable Timing Discrepancy
Vulnerability summary
CVE-2022-31142 is a high (CVSS 7.5) Observable Timing Discrepancy vulnerability in fastify bearer-auth. EPSS estimates a 1.50% chance of exploitation in the next 30 days, higher than 73.8% of scored vulnerabilities.
Timeline
- 14-07-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack. Version 7.0.2 and 8.0.1 of @fastify/bearer-auth contain a patch. There are currently no known workarounds. The package fastify-bearer-auth, which covers versions 6.0.3 and prior, is also vulnerable starting at version 5.0.1. Users of fastify-bearer-auth should upgrade to a patched version of @fastify/bearer-auth.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.50%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
+0.04 pp
From 1.45% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Affected systems
Fastify2 products
- bearer-auth≥ 5.0.1, < 7.0.2 | 8.0.0
- fastify-bearer-auth≥ 5.0.1, < 7.0.2 | = 8.0.0
@fastify1 product
- bearer-auth< 7.0.2 | ≥ 8.0.0, < 8.0.1
Npm1 product
- fastify-bearer-auth≥ 5.0.1, ≤ 6.0.3
3 vendors · 4 products
References
7 links- github.com/fastify/fastify-bearer-auth/security/advisories/GHSA-376v-xgjx-7mfrX Refsource CONFIRMWEBThird Party Advisory
- github.com/fastify/fastify-bearer-auth/commit/0c468a616d7e56126dc468150f6a5a92e530b8e4X Refsource MISCWEBPatchThird Party Advisory
- github.com/fastify/fastify-bearer-auth/commit/39353b15409ee99474545f615ffb16180cf3b716X Refsource MISCWEBPatchThird Party Advisory
- github.com/fastify/fastify-bearer-auth/commit/f921a0582dc83112039004a9b5041141b50c5b3fX Refsource MISCWEBPatchThird Party Advisory
