CVE-2026-21713

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-21713
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21713.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-21713
Aliases
Downstream
Related
Published
2026-03-30T19:07:28.356Z
Modified
2026-08-21T03:46:34.866509157Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.

Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.

This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "20.20.1"
                },
                {
                    "last_affected": "20.20.1"
                },
                {
                    "introduced": "22.22.1"
                },
                {
                    "last_affected": "22.22.1"
                },
                {
                    "introduced": "24.14.0"
                },
                {
                    "last_affected": "24.14.0"
                },
                {
                    "introduced": "25.8.1"
                },
                {
                    "last_affected": "25.8.1"
                },
                {
                    "introduced": "4.0"
                },
                {
                    "fixed": "4.*"
                },
                {
                    "introduced": "5.0"
                },
                {
                    "fixed": "5.*"
                },
                {
                    "introduced": "6.0"
                },
                {
                    "fixed": "6.*"
                },
                {
                    "introduced": "7.0"
                },
                {
                    "fixed": "7.*"
                },
                {
                    "introduced": "8.0"
                },
                {
                    "fixed": "8.*"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "fixed": "9.*"
                },
                {
                    "introduced": "10.0"
                },
                {
                    "fixed": "10.*"
                },
                {
                    "introduced": "11.0"
                },
                {
                    "fixed": "11.*"
                },
                {
                    "introduced": "12.0"
                },
                {
                    "fixed": "12.*"
                },
                {
                    "introduced": "13.0"
                },
                {
                    "fixed": "13.*"
                },
                {
                    "introduced": "14.0"
                },
                {
                    "fixed": "14.*"
                },
                {
                    "introduced": "15.0"
                },
                {
                    "fixed": "15.*"
                },
                {
                    "introduced": "16.0"
                },
                {
                    "fixed": "16.*"
                },
                {
                    "introduced": "17.0"
                },
                {
                    "fixed": "17.*"
                },
                {
                    "introduced": "18.0"
                },
                {
                    "fixed": "18.*"
                },
                {
                    "introduced": "19.0"
                },
                {
                    "fixed": "19.*"
                }
            ]
        }
    ],
    "cna_assigner": "hackerone",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21713.json"
}
References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/node
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
eb5334341594489a54d99812a227d921c0221304
Introduced
12fb157f79da8c094a54bc99370994941c28c235
Last affected
b4acf0c9393e4b31c4937564f059c672967161d8
Introduced
c5349f43cd66d2aa02d86414c9ed426f71d3ae48
Last affected
f657bb8ed86365ff3fdbe32e27563e778b41486a
Introduced
0b3a10d4c8ba5e15429287e725d22615be896e95
Last affected
2ea7a7b67c3d698a0e80d2591365e2dc5c5f7a81
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "20.20.1"
        },
        {
            "introduced": "22.0.0"
        },
        {
            "last_affected": "22.22.1"
        },
        {
            "introduced": "24.0.0"
        },
        {
            "last_affected": "24.14.0"
        },
        {
            "introduced": "25.0.0"
        },
        {
            "last_affected": "25.8.1"
        }
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.6
v0.1.0
v0.1.1
v0.1.10
v0.1.100
v0.1.101
v0.1.102
v0.1.103
v0.1.104
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.15
v0.1.16
v0.1.17
v0.1.18
v0.1.19
v0.1.2
v0.1.20
v0.1.21
v0.1.22
v0.1.23
v0.1.24
v0.1.25
v0.1.26
v0.1.27
v0.1.28
v0.1.29
v0.1.3
v0.1.30
v0.1.31
v0.1.32
v0.1.33
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.1.92
v0.1.93
v0.1.94
v0.1.95
v0.1.96
v0.1.97
v0.1.98
v0.1.99
v0.2.0
v0.3.0
v0.3.1
v0.3.2
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.4.0
v0.5.0
v0.5.1
v0.5.10
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.5-rc1
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.6.1
v0.7.0
v0.7.2
v0.7.3
v1.*
v1.0.1
v1.0.1-release
v1.0.2
v1.0.2-release
v1.0.3
v1.0.4
v1.1.0
v1.2.0
v1.3.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.7.0
v1.7.1
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.5.0
v20.*
v20.0.0
v20.1.0
v20.10.0
v20.11.0
v20.11.1
v20.12.0
v20.12.1
v20.12.2
v20.13.0
v20.13.1
v20.14.0
v20.15.0
v20.15.1
v20.16.0
v20.17.0
v20.18.0
v20.18.1
v20.18.2
v20.18.3
v20.19.0
v20.19.1
v20.19.2
v20.19.3
v20.19.4
v20.19.5
v20.19.6
v20.2.0
v20.20.0
v20.20.1
v20.3.0
v20.3.1
v20.4.0
v20.5.0
v20.5.1
v20.6.0
v20.6.1
v20.7.0
v20.8.0
v20.8.1
v20.9.0
v22.*
v22.0.0
v22.1.0
v22.10.0
v22.11.0
v22.12.0
v22.13.0
v22.13.1
v22.14.0
v22.15.0
v22.15.1
v22.16.0
v22.17.0
v22.17.1
v22.18.0
v22.19.0
v22.2.0
v22.20.0
v22.21.0
v22.21.1
v22.22.0
v22.22.1
v22.3.0
v22.4.0
v22.4.1
v22.5.0
v22.5.1
v22.6.0
v22.7.0
v22.8.0
v22.9.0
v24.*
v24.0.0
v24.0.1
v24.0.2
v24.1.0
v24.10.0
v24.11.0
v24.11.1
v24.12.0
v24.13.0
v24.13.1
v24.14.0
v24.2.0
v24.3.0
v24.4.0
v24.4.1
v24.5.0
v24.6.0
v24.7.0
v24.8.0
v24.9.0
v25.*
v25.0.0
v25.1.0
v25.2.0
v25.2.1
v25.3.0
v25.4.0
v25.5.0
v25.6.0
v25.6.1
v25.7.0
v25.8.0
v25.8.1
v3.*
v3.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21713.json"