REDHAT-BUG-2453160: Medium severity OpenJS Foundation Node.js vulnerability
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.
Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2453160?
The severity of REDHAT-BUG-2453160 is medium, with a score of 4.
How does REDHAT-BUG-2453160 impact Node.js HMAC verification?
REDHAT-BUG-2453160 impacts Node.js HMAC verification by using a non-constant-time comparison that may leak timing information.
What risks are associated with REDHAT-BUG-2453160?
The risks associated with REDHAT-BUG-2453160 include potential signature verification vulnerabilities that could be exploited through high-resolution timing attacks.
How do I fix the vulnerability described in REDHAT-BUG-2453160?
To fix the vulnerability described in REDHAT-BUG-2453160, update to a patched version of Node.js where the HMAC verification issue has been addressed.
When was REDHAT-BUG-2453160 published?
REDHAT-BUG-2453160 was published on March 30, 2026.