{"id":"GHSA-c35v-qwqg-87jc","aliases":[],"status":"published","title":"express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison","description":"Versions of `express-basic-auth` prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.\n\n\n## Recommendation\n\nUpgrade to version 1.1.7 or later.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208"],"published":"2019-06-06T15:32:32Z","modified":"2023-01-11T05:08:06Z","fixes":[{"ecosystem":"npm","package":"express-basic-auth","fixed_in":["1.1.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"express-basic-auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7"}]}]},{"source":"osv","ecosystem":"npm","package":"express-basic-auth","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.7"}]}]}],"references":[{"url":"https://github.com/webpack-contrib/webpack-bundle-analyzer/issues/263","tags":["web"]},{"url":"https://github.com/LionC/express-basic-auth/pull/20","tags":["web"]},{"url":"https://github.com/LionC/express-basic-auth/pull/21","tags":["web"]},{"url":"https://github.com/LionC/express-basic-auth/commit/00bb29fdd638f5cda8025d4398be97d528ce3f6f","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-EXPRESSBASICAUTH-174345","tags":["web"]},{"url":"https://www.npmjs.com/advisories/827","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c35v-qwqg-87jc"},{"url":"https://github.com/LionC/express-basic-auth","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-c35v-qwqg-87jc","title":"express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison","description":"Versions of `express-basic-auth` prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.\n\n\n## Recommendation\n\nUpgrade to version 1.1.7 or later.","status":"published","published":"2019-06-06T15:32:32Z","modified":"2023-01-11T05:08:06Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:36:13.23016Z"}],"osv":[{"id":"GHSA-c35v-qwqg-87jc","title":"express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison","description":"Versions of `express-basic-auth` prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.\n\n\n## Recommendation\n\nUpgrade to version 1.1.7 or later.","status":"published","published":"2019-06-06T15:32:32Z","modified":"2022-08-03T16:27:53Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:46:44.571161Z"}]}}