CVE-2026-21713: Medium severity Node.js Node.js vulnerability
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.
Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21713?
CVE-2026-21713 is considered a medium severity vulnerability due to its potential for timing attacks.
How do I fix CVE-2026-21713?
To mitigate CVE-2026-21713, update Node.js to a version that is patched against this vulnerability.
Which versions of Node.js are affected by CVE-2026-21713?
CVE-2026-21713 affects Node.js versions 20.0.0 to 21.0.0, 22.0.0 to 23.0.0, 24.0.0 to 25.0.0, and 25.0.0 to 26.0.0.
What is the impact of CVE-2026-21713?
The impact of CVE-2026-21713 includes potential exposure of sensitive data due to timing attacks that can leak information about user-provided signatures.
Is CVE-2026-21713 a critical vulnerability?
CVE-2026-21713 is not classified as critical, but it is important to address due to its implications for security in certain threat models.