CVE-2024-47178

basic-auth-connect's callback uses time unsafe string comparison

8.7 HighFix available

basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.52%Up 0.5 points since Oct 1, 2024

What each source reports

CVE List Score used 8.7

basic-auth-connect's callback uses time unsafe string comparison

Record: CVE-2024-47178
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-208
Updated: 2026-11-02

EUVDEUVD-2024-2748 8.7

Record: EUVD-2024-2748
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7p89-p6hx-q4fw 8.7

basic-auth-connect's callback uses time unsafe string comparison

Impact

basic-auth-connect <1.1.0 uses a timing-unsafe equality comparison that can leak timing information

Patches

this issue has been fixed in basic-auth-connect 1.1.0

References

Record: GHSA-7p89-p6hx-q4fw
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-208
Updated: 2026-11-02

NVD 8.7

Record: CVE-2024-47178
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-208
Updated: 2026-11-02

OSV 8.7

basic-auth-connect's callback uses time unsafe string comparison

Record: CVE-2024-47178
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-208
Updated: 2026-11-02

OSVGHSA-7p89-p6hx-q4fw 8.7

basic-auth-connect's callback uses time unsafe string comparison

Impact

basic-auth-connect <1.1.0 uses a timing-unsafe equality comparison that can leak timing information

Patches

this issue has been fixed in basic-auth-connect 1.1.0

References

Record: GHSA-7p89-p6hx-q4fw
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-208
Updated: 2026-11-02

OSVCLSA-2026-1773533800 No score

TuxCare security update for basic-auth-connect (1 CVE)

TuxCare rebuilt basic-auth-connect to address 1 CVE. Fixed in 1.0.0-tuxcare.1.

Record: CLSA-2026-1773533800
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2024-47178 No score

CVE-2024-47178 in basic-auth-connect - Patched by Root

Root has patched CVE-2024-47178 in the basic-auth-connect package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2024-47178
Updated: 2026-11-02

Affected products

expressjs basic-auth-connect

Affected packages

Affected packages
Package	Affected	Fixed
`basic-auth-connect` npm	before 1.1.0	1.1.0
`basic-auth-connect` TuxCare:npm	1.0.0-tuxcare.0 up to 1.0.0-tuxcare.1, plus listed versions 1.0.0	1.0.0-tuxcare.1
`basic-auth-connect` Root:npm	before 1.0.0-aikido.1	1.0.0-aikido.1
`@rootio/basic-auth-connect` Root:npm	before 1.0.0-root.io.1	1.0.0-root.io.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-47178 is a high vulnerability (CVSS 8.7) in Expressjs Basic-auth-connect, published September 30, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in basic-auth-connect 1.1.0.