Node.js Timing Side-Channel Vulnerability in HMAC Verification Could Lead to MAC Forgery

A timing side-channel vulnerability has been identified in Node.js HMAC verification. The flaw arises because user-provided signatures are validated using a non-constant-time comparison, which can inadvertently leak timing information based on the number of matching bytes. In environments where high-resolution timing measurements are feasible, this behavior could be exploited as a timing oracle to infer HMAC values. This issue affects Node.js versions 20.x, 22.x, 24.x, and 25.x.

Impact

Exploitation of this vulnerability could allow an attacker to use timing measurements to infer HMAC values, potentially leading to MAC forgery.

Remediation

Users can upgrade to Node.js versions 20.20.2, 22.22.2, 24.14.1, or 25.8.2 to address this vulnerability.