CVE-2026-21713

Aliases:DEBIAN-CVE-2026-21713ALPINE-CVE-2026-21713CGA-27w9-vgc6-xqfxCGA-2gcp-2m6v-47vjCGA-7479-r486-84vcCGA-7mjx-p3x8-w55wCGA-8x6q-3x4q-6xjxCGA-h29q-7f57-3v4mCGA-jj4r-fjv7-6255CGA-jph8-g9xf-4pjpCGA-r9v6-q4gv-vm9pCGA-rqhp-77fg-2jjq
Advisory lineage Upstream: 0 Downstream: 21
Analyzed
Published: 30 Mar 2026, 19:07
Last modified:10 May 2026, 13:17

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
5.9 MEDIUM
v3.0 (cve.org)
EPSS Score
0.39% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

30 Mar 2026, 19:07
Published
Vulnerability first disclosed
10 May 2026, 13:17
Last Modified
Vulnerability information updated

Description

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

CVSS Metrics

  • v3.0•MEDIUM•Score: 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.39%• Percentile: 32%

Techniques & Countermeasures

  • CWE-208•Observable Timing Discrepancy

    Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Affected Systems

  • alpine•nodejs

    < 22.22.2-r0 | < 22.22.2-r0 | < 24.14.1-r0 | < 24.14.1-r0

  • chainguard•nodejs-16

    all

  • chainguard•nodejs-18

    all

  • chainguard•nodejs-21

    all

  • chainguard•nodejs-22

    < 22.22.3-r0

  • chainguard•nodejs-23

    all

  • wolfi•nodejs-16

    all

  • wolfi•nodejs-18

    all

  • wolfi•nodejs-21

    all

  • wolfi•nodejs-22

    < 22.22.3-r0

  • wolfi•nodejs-23

    all

  • debian•nodejs

    < 18.20.4+dfsg-1~deb12u2 | < 20.19.2+dfsg-1+deb13u2 | < 22.22.2+dfsg+~cs22.19.15-1

  • nodejs•node

    20.20.1 | 22.22.1 | 24.14.0 | 25.8.1 | ≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.* | ≥ 13.0, < 13.* | ≥ 14.0, < 14.* | ≥ 15.0, < 15.* | ≥ 16.0, < 16.* | ≥ 17.0, < 17.* | ≥ 18.0, < 18.* | ≥ 19.0, < 19.*

  • nodejs•node.js

    ≤ 20.20.1 | ≥ 22.0.0, ≤ 22.22.1 | ≥ 24.0.0, ≤ 24.14.0 | ≥ 25.0.0, ≤ 25.8.1

References (5)