CVE-2016-1000236

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used...

CVE-2016-1000236

CVE-2016-1000236 affects the node-cookie-signature package prior to v1.0.6. Root cause: a timing-attack due to a non-constant-time comparison in signature verification. Impact: under favorable network conditions, an attacker could deduce the secret by exploiting slight timing differences (per-cha...