CVE-2022-31142

The CVE-2022-31142 issue affects the Fastify bearer-auth plugin. Vulnerable releases are @fastify/bearer-auth versions prior to 7.0.2 and 8.0.1, where crypto.timingSafeEqual is not used securely, enabling a potential timing-based length deduction attack on bearer tokens (RFC 6750 token has base64...

CVE-2022-31142 Potential Timing Attack Vector in @fastify/bearer-auth

@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750,...