Every CVESearch/Get API key

GHSA-c35v-qwqg-87jc

express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison

3.1 LowFix available

GHSA-c35v-qwqg-87jc is a low vulnerability (CVSS 3.1) in express-basic-auth, published June 6, 2019. No source lists public exploit code. Fixed in express-basic-auth 1.1.7.

Severity
3.1 LowCVSS 3.1, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.1.7express-basic-auth

Description

Versions of express-basic-auth prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.

Recommendation

Upgrade to version 1.1.7 or later.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Affected packages

Affected packages
PackageAffectedFixed
express-basic-auth
npm
before 1.1.7
1.1.7

What each source reports

GitHub Advisories Score used3.1

express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison

Versions of express-basic-auth prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.

Recommendation

Upgrade to version 1.1.7 or later.

Record
GHSA-c35v-qwqg-87jc
CVSS 3.1
3.1 LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-208
Updated
2026-11-02
OSV3.1

express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison

Versions of express-basic-auth prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.

Recommendation

Upgrade to version 1.1.7 or later.

Record
GHSA-c35v-qwqg-87jc
CVSS 3.1
3.1 LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-208
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open