CVE-2016-1000236
cookie-signature Timing Attack
CVE-2016-1000236 is a medium vulnerability (CVSS 4.4) in Cookie-signature Project Cookie-signature, published November 19, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. Fixed in cookie-signature 1.0.4.
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
- Record
CVE-2016-1000236- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:P/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
- Record
CVE-2016-1000236- Updated
- 2026-11-02
EUVDEUVD-2020-0260 No score
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
- Record
EUVD-2020-0260- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-92vm-wfm5-mxvv
cookie-signature Timing Attack
Affected versions of cookie-signature are vulnerable to timing attacks as a result of using a fail-early comparison instead of a constant-time comparison.
Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback on the correctness of a guess via miniscule timing differences.
Under favorable network conditions, an attacker can exploit this to guess the secret in no more than charset*length guesses, instead of charset^length guesses required were the timing attack not present.
Recommendation
Update to 1.0.4 or later.
- Record
GHSA-92vm-wfm5-mxvv- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVAZL-44412
CVE-2016-1000236 affecting package nodejs-nodemon 2.0.3-5
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
- Record
AZL-44412- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
- Record
CVE-2016-1000236- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2016-1000236
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
- Record
DEBIAN-CVE-2016-1000236- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-92vm-wfm5-mxvv
cookie-signature Timing Attack
Affected versions of cookie-signature are vulnerable to timing attacks as a result of using a fail-early comparison instead of a constant-time comparison.
Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback on the correctness of a guess via miniscule timing differences.
Under favorable network conditions, an attacker can exploit this to guess the secret in no more than charset*length guesses, instead of charset^length guesses required were the timing attack not present.
Recommendation
Update to 1.0.4 or later.
- Record
GHSA-92vm-wfm5-mxvv- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-1000236
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
- Record
UBUNTU-CVE-2016-1000236- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1773879459 No score
TuxCare security update for cookie-signature (1 CVE)
TuxCare rebuilt cookie-signature to address 1 CVE. Fixed in 1.0.0-tuxcare.1.
- Record
CLSA-2026-1773879459- Updated
- 2026-11-02
OSVCLSA-2026-1784683082 No score
TuxCare security update for cookie-signature (1 CVE)
TuxCare rebuilt cookie-signature to address 1 CVE. Fixed in 1.0.1-tuxcare.1.
- Record
CLSA-2026-1784683082- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cookie-signaturenpm |
before 1.0.4 | 1.0.4 |
nodejs-nodemonAzure Linux:3 |
through 2.0.3-5 | None known |
cookie-signatureTuxCare:npm |
1.0.0-tuxcare.0 up to 1.0.0-tuxcare.1, plus listed versions 1.0.0 |
1.0.0-tuxcare.1 |
cookie-signatureTuxCare:npm |
1.0.1-tuxcare.0 up to 1.0.1-tuxcare.1, plus listed versions 1.0.1 |
1.0.1-tuxcare.1 |
node-cookie-signatureDebian:12 |
before 1.1.0-1 | 1.1.0-1 |
node-cookie-signatureDebian:13 |
before 1.1.0-1 | 1.1.0-1 |
node-cookie-signatureDebian:14 |
before 1.1.0-1 | 1.1.0-1 |
node-cookie-signatureUbuntu:16.04:LTS |
All versions, plus listed versions 1.0.3-1 |
None known |
node-cookie-signatureUbuntu:18.04:LTS |
All versions, plus listed versions 1.0.3-11.0.3-1ubuntu1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
security-tracker.debian.org/tracker/CVE-2016-1000236
bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000236
bugs.debian.org/cgi-bin/bugreport.cgi?bug=838618
mail-archive.com/secure-testing-team%40lists.alioth.debian.org/msg06583.html
travis-ci.com/nodejs/security-wg/builds/76423102
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-1000236
github.com/tj/node-cookie-signature/commit/2c4df6b6cee540f30876198cd0b5bebf28528c07
npmjs.com/advisories/134
ubuntu.com/security/CVE-2016-1000236
nodesecurity.io/advisories/134
cve.org/CVERecord?id=CVE-2016-1000236