fastify-bearer-auth (6.3.0-rc.1) potentially affected by CVE-2022-31142 via @fastify/bearer-auth (7.0.0-rc.1)

@fastify/bearer-auth NPM version 7.0.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/bearer-auth and may be impacted: - fastify-bearer-auth 6.3.0-rc.1 Source cves: CVE-2022-31142 Source advisory: OSV:GHSA-376V-XGJX-7MFR...

CVE-2022-31142

The CVE-2022-31142 issue affects the Fastify bearer-auth plugin. Vulnerable releases are @fastify/bearer-auth versions prior to 7.0.2 and 8.0.1, where crypto.timingSafeEqual is not used securely, enabling a potential timing-based length deduction attack on bearer tokens (RFC 6750 token has base64...

CVE-2022-31142 Potential Timing Attack Vector in @fastify/bearer-auth

@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750,...