[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-21713":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T16:22:42.503Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":78,"aliases":79,"duplicate_of":9,"upstream":80,"downstream":81,"duplicates":120,"related":121,"reserved_at":9,"published_at":136,"modified_at":137,"state":138,"summary":139,"references_raw":148,"kevs":154,"epss":155,"epss_history":158,"metrics":434,"affected":442},"CVE-2026-21713","A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.\r\n\r\nNode.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.\r\n\r\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x**.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-208","Observable Timing Discrepancy","Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.","weakness","Incomplete","Base",[19,23,35],{"id":20,"name":21,"techniques":22},"CAPEC-462","Cross-Domain Search Timing",[],{"id":24,"name":25,"techniques":26},"CAPEC-541","Application Fingerprinting",[27],{"id":28,"name":29,"tactics":30,"countermeasures":34},"T1592.002","Software",[31],{"id":32,"name":33},"TA0043","Reconnaissance",[],{"id":36,"name":37,"techniques":38},"CAPEC-580","System Footprinting",[39],{"id":40,"name":41,"tactics":42,"countermeasures":46},"T1082","System Information Discovery",[43],{"id":44,"name":45},"TA0102","Discovery",[47,52,56,61,66,70,74],{"id":48,"name":49,"tactic":50},"D3-SCA","System Call Analysis",{"name":51},"Detect",{"id":53,"name":54,"tactic":55},"D3-PSA","Process Spawn Analysis",{"name":51},{"id":57,"name":58,"tactic":59},"D3-DE","Decoy Environment",{"name":60},"Deceive",{"id":62,"name":63,"tactic":64},"D3-SCF","System Call Filtering",{"name":65},"Isolate",{"id":67,"name":68,"tactic":69},"D3-EAL","Executable Allowlisting",{"name":65},{"id":71,"name":72,"tactic":73},"D3-EDL","Executable Denylisting",{"name":65},{"id":75,"name":76,"tactic":77},"D3-HBPI","Hardware-based Process Isolation",{"name":65},[],[],[],[82,84,86,88,90,92,94,96,98,100,102,104,106,108,110,112,114,116,118],{"_key":83},"DSA-6183-1",{"_key":85},"OPENSUSE-SU-2026:10504-1",{"_key":87},"SUSE-SU-2026:1299-1",{"_key":89},"MGASA-2026-0071",{"_key":91},"SUSE-SU-2026:1363-1",{"_key":93},"SUSE-SU-2026:1371-1",{"_key":95},"SUSE-SU-2026:1478-1",{"_key":97},"SUSE-SU-2026:1509-1",{"_key":99},"SUSE-SU-2026:21181-1",{"_key":101},"OPENSUSE-SU-2026:20519-1",{"_key":103},"UBUNTU-CVE-2026-21713",{"_key":105},"ALPINE-CVE-2026-21713",{"_key":107},"DEBIAN-CVE-2026-21713",{"_key":109},"OPENSUSE-SU-2026:11110-1",{"_key":111},"SUSE-SU-2026:22368-1",{"_key":113},"OPENSUSE-SU-2026:21058-1",{"_key":115},"RHSA-2026:7350",{"_key":117},"RHSA-2026:7670",{"_key":119},"RHSA-2026:7675",[],[122,123,124,125,126,127,128,129,130,131,132,133,134],{"_key":85},{"_key":87},{"_key":89},{"_key":91},{"_key":93},{"_key":95},{"_key":97},{"_key":99},{"_key":101},{"_key":109},{"_key":111},{"_key":113},{"_key":135},"CGA-9V96-6P33-R65P","2026-03-30T19:07:28.356Z","2026-05-10T13:17:50.281Z","Awaiting Analysis",{"cisa_kev":140,"cisa_ransomware":140,"cisa_vendor":9,"epss_severity":141,"epss_score":142,"severity":143,"severity_score":144,"severity_version":145,"severity_source":146,"severity_vector":147,"severity_status":138},false,"low",0.00385,"medium",5.9,"v3.0","cve.org","CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",[149],{"url":150,"sources":151,"tags":153},"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",[146,152],"nvd",[],[],{"date":156,"score":142,"percentile":157},"2026-07-05",0.30521,[159,163,166,169,172,176,180,183,186,189,192,195,198,201,204,207,210,213,216,219,222,225,229,232,235,238,241,244,247,250,253,256,260,263,266,269,272,275,278,281,284,287,291,294,297,300,303,305,308,311,314,317,320,323,326,329,332,335,338,341,344,347,350,353,356,359,362,365,369,372,375,378,381,384,387,389,392,395,398,401,404,407,410,413,416,419,422,425,428,431],{"date":160,"score":161,"percentile":162},"2026-03-31",0.00011,0.01435,{"date":164,"score":161,"percentile":165},"2026-04-01",0.01428,{"date":167,"score":161,"percentile":168},"2026-04-02",0.0144,{"date":170,"score":161,"percentile":171},"2026-04-03",0.01443,{"date":173,"score":174,"percentile":175},"2026-04-04",0.00016,0.03543,{"date":177,"score":178,"percentile":179},"2026-04-05",0.00021,0.05577,{"date":181,"score":178,"percentile":182},"2026-04-06",0.05564,{"date":184,"score":178,"percentile":185},"2026-04-07",0.05575,{"date":187,"score":178,"percentile":188},"2026-04-08",0.05613,{"date":190,"score":178,"percentile":191},"2026-04-09",0.05638,{"date":193,"score":178,"percentile":194},"2026-04-10",0.05621,{"date":196,"score":178,"percentile":197},"2026-04-11",0.05611,{"date":199,"score":178,"percentile":200},"2026-04-12",0.05602,{"date":202,"score":178,"percentile":203},"2026-04-13",0.05595,{"date":205,"score":178,"percentile":206},"2026-04-14",0.05532,{"date":208,"score":178,"percentile":209},"2026-04-15",0.05536,{"date":211,"score":178,"percentile":212},"2026-04-16",0.05546,{"date":214,"score":178,"percentile":215},"2026-04-17",0.05557,{"date":217,"score":178,"percentile":218},"2026-04-18",0.0556,{"date":220,"score":178,"percentile":221},"2026-04-19",0.05543,{"date":223,"score":178,"percentile":224},"2026-04-20",0.05544,{"date":226,"score":227,"percentile":228},"2026-04-21",0.00027,0.07681,{"date":230,"score":227,"percentile":231},"2026-04-22",0.07697,{"date":233,"score":227,"percentile":234},"2026-04-23",0.07728,{"date":236,"score":227,"percentile":237},"2026-04-24",0.07629,{"date":239,"score":227,"percentile":240},"2026-04-25",0.07622,{"date":242,"score":227,"percentile":243},"2026-04-26",0.07607,{"date":245,"score":227,"percentile":246},"2026-04-27",0.07591,{"date":248,"score":227,"percentile":249},"2026-04-28",0.0757,{"date":251,"score":227,"percentile":252},"2026-04-29",0.07571,{"date":254,"score":227,"percentile":255},"2026-04-30",0.07579,{"date":257,"score":258,"percentile":259},"2026-05-01",0.0003,0.08344,{"date":261,"score":258,"percentile":262},"2026-05-02",0.08397,{"date":264,"score":258,"percentile":265},"2026-05-03",0.08378,{"date":267,"score":258,"percentile":268},"2026-05-04",0.08336,{"date":270,"score":258,"percentile":271},"2026-05-05",0.08334,{"date":273,"score":258,"percentile":274},"2026-05-06",0.08348,{"date":276,"score":258,"percentile":277},"2026-05-07",0.08476,{"date":279,"score":258,"percentile":280},"2026-05-08",0.08506,{"date":282,"score":258,"percentile":283},"2026-05-09",0.08556,{"date":285,"score":258,"percentile":286},"2026-05-10",0.08557,{"date":288,"score":289,"percentile":290},"2026-05-11",0.00012,0.0172,{"date":292,"score":289,"percentile":293},"2026-05-12",0.01707,{"date":295,"score":289,"percentile":296},"2026-05-13",0.01714,{"date":298,"score":289,"percentile":299},"2026-05-14",0.01716,{"date":301,"score":289,"percentile":302},"2026-05-15",0.01715,{"date":304,"score":289,"percentile":296},"2026-05-16",{"date":306,"score":289,"percentile":307},"2026-05-17",0.0171,{"date":309,"score":289,"percentile":310},"2026-05-18",0.01695,{"date":312,"score":289,"percentile":313},"2026-05-19",0.01692,{"date":315,"score":289,"percentile":316},"2026-05-20",0.01689,{"date":318,"score":289,"percentile":319},"2026-05-21",0.01677,{"date":321,"score":289,"percentile":322},"2026-05-22",0.01797,{"date":324,"score":289,"percentile":325},"2026-05-23",0.01794,{"date":327,"score":289,"percentile":328},"2026-05-24",0.01793,{"date":330,"score":289,"percentile":331},"2026-05-25",0.01783,{"date":333,"score":289,"percentile":334},"2026-05-26",0.01776,{"date":336,"score":289,"percentile":337},"2026-05-27",0.0179,{"date":339,"score":289,"percentile":340},"2026-05-28",0.01786,{"date":342,"score":289,"percentile":343},"2026-05-29",0.01795,{"date":345,"score":289,"percentile":346},"2026-05-30",0.01803,{"date":348,"score":289,"percentile":349},"2026-05-31",0.01796,{"date":351,"score":289,"percentile":352},"2026-06-01",0.01782,{"date":354,"score":289,"percentile":355},"2026-06-02",0.01775,{"date":357,"score":289,"percentile":358},"2026-06-03",0.01766,{"date":360,"score":289,"percentile":361},"2026-06-04",0.01764,{"date":363,"score":289,"percentile":364},"2026-06-05",0.01774,{"date":366,"score":367,"percentile":368},"2026-06-06",0.00013,0.01985,{"date":370,"score":367,"percentile":371},"2026-06-07",0.01975,{"date":373,"score":367,"percentile":374},"2026-06-08",0.01961,{"date":376,"score":367,"percentile":377},"2026-06-09",0.01955,{"date":379,"score":367,"percentile":380},"2026-06-10",0.01954,{"date":382,"score":367,"percentile":383},"2026-06-11",0.01957,{"date":385,"score":367,"percentile":386},"2026-06-12",0.0196,{"date":388,"score":367,"percentile":374},"2026-06-13",{"date":390,"score":367,"percentile":391},"2026-06-14",0.0197,{"date":393,"score":142,"percentile":394},"2026-06-15",0.30099,{"date":396,"score":142,"percentile":397},"2026-06-16",0.30148,{"date":399,"score":142,"percentile":400},"2026-06-17",0.30167,{"date":402,"score":142,"percentile":403},"2026-06-18",0.30199,{"date":405,"score":142,"percentile":406},"2026-06-19",0.30183,{"date":408,"score":142,"percentile":409},"2026-06-20",0.30168,{"date":411,"score":142,"percentile":412},"2026-06-21",0.30151,{"date":414,"score":142,"percentile":415},"2026-06-22",0.30134,{"date":417,"score":142,"percentile":418},"2026-06-23",0.30214,{"date":420,"score":142,"percentile":421},"2026-06-24",0.30246,{"date":423,"score":142,"percentile":424},"2026-06-25",0.30332,{"date":426,"score":142,"percentile":427},"2026-06-26",0.30373,{"date":429,"score":142,"percentile":430},"2026-06-27",0.30408,{"date":432,"score":142,"percentile":433},"2026-06-28",0.30382,[435,440],{"source":146,"cvss_v2_0":9,"cvss_v3_0":436,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":144,"baseSeverity":437,"vectorString":147,"impactScore":438,"exploitabilityScore":439},"MEDIUM",6,5.6,{"source":152,"cvss_v2_0":9,"cvss_v3_0":441,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":144,"baseSeverity":437,"vectorString":147,"impactScore":438,"exploitabilityScore":439},[443],{"ecosystem":9,"name":444,"vendor":445,"product":444,"cpe_part":446,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":447},"node","nodejs","a",[448,453,456,459,462,467,471,475,479,483,487,491,495,499,503,507,511,515,519,523],{"version":449,"is_range":450,"range_type":146,"version_start":451,"version_start_type":452,"version_end":451,"version_end_type":452,"fixed_in":9},">= 20.20.1, \u003C= 20.20.1",true,"20.20.1","including",{"version":454,"is_range":450,"range_type":146,"version_start":455,"version_start_type":452,"version_end":455,"version_end_type":452,"fixed_in":9},">= 22.22.1, \u003C= 22.22.1","22.22.1",{"version":457,"is_range":450,"range_type":146,"version_start":458,"version_start_type":452,"version_end":458,"version_end_type":452,"fixed_in":9},">= 24.14.0, \u003C= 24.14.0","24.14.0",{"version":460,"is_range":450,"range_type":146,"version_start":461,"version_start_type":452,"version_end":461,"version_end_type":452,"fixed_in":9},">= 25.8.1, \u003C= 25.8.1","25.8.1",{"version":463,"is_range":450,"range_type":146,"version_start":464,"version_start_type":452,"version_end":465,"version_end_type":466,"fixed_in":9},">= 4.0, \u003C 4.*","4.0","4.*","excluding",{"version":468,"is_range":450,"range_type":146,"version_start":469,"version_start_type":452,"version_end":470,"version_end_type":466,"fixed_in":9},">= 5.0, \u003C 5.*","5.0","5.*",{"version":472,"is_range":450,"range_type":146,"version_start":473,"version_start_type":452,"version_end":474,"version_end_type":466,"fixed_in":9},">= 6.0, \u003C 6.*","6.0","6.*",{"version":476,"is_range":450,"range_type":146,"version_start":477,"version_start_type":452,"version_end":478,"version_end_type":466,"fixed_in":9},">= 7.0, \u003C 7.*","7.0","7.*",{"version":480,"is_range":450,"range_type":146,"version_start":481,"version_start_type":452,"version_end":482,"version_end_type":466,"fixed_in":9},">= 8.0, \u003C 8.*","8.0","8.*",{"version":484,"is_range":450,"range_type":146,"version_start":485,"version_start_type":452,"version_end":486,"version_end_type":466,"fixed_in":9},">= 9.0, \u003C 9.*","9.0","9.*",{"version":488,"is_range":450,"range_type":146,"version_start":489,"version_start_type":452,"version_end":490,"version_end_type":466,"fixed_in":9},">= 10.0, \u003C 10.*","10.0","10.*",{"version":492,"is_range":450,"range_type":146,"version_start":493,"version_start_type":452,"version_end":494,"version_end_type":466,"fixed_in":9},">= 11.0, \u003C 11.*","11.0","11.*",{"version":496,"is_range":450,"range_type":146,"version_start":497,"version_start_type":452,"version_end":498,"version_end_type":466,"fixed_in":9},">= 12.0, \u003C 12.*","12.0","12.*",{"version":500,"is_range":450,"range_type":146,"version_start":501,"version_start_type":452,"version_end":502,"version_end_type":466,"fixed_in":9},">= 13.0, \u003C 13.*","13.0","13.*",{"version":504,"is_range":450,"range_type":146,"version_start":505,"version_start_type":452,"version_end":506,"version_end_type":466,"fixed_in":9},">= 14.0, \u003C 14.*","14.0","14.*",{"version":508,"is_range":450,"range_type":146,"version_start":509,"version_start_type":452,"version_end":510,"version_end_type":466,"fixed_in":9},">= 15.0, \u003C 15.*","15.0","15.*",{"version":512,"is_range":450,"range_type":146,"version_start":513,"version_start_type":452,"version_end":514,"version_end_type":466,"fixed_in":9},">= 16.0, \u003C 16.*","16.0","16.*",{"version":516,"is_range":450,"range_type":146,"version_start":517,"version_start_type":452,"version_end":518,"version_end_type":466,"fixed_in":9},">= 17.0, \u003C 17.*","17.0","17.*",{"version":520,"is_range":450,"range_type":146,"version_start":521,"version_start_type":452,"version_end":522,"version_end_type":466,"fixed_in":9},">= 18.0, \u003C 18.*","18.0","18.*",{"version":524,"is_range":450,"range_type":146,"version_start":525,"version_start_type":452,"version_end":526,"version_end_type":466,"fixed_in":9},">= 19.0, \u003C 19.*","19.0","19.*"]