CVE-2022-31142

@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750,...

PT-2022-20560

Name of the Vulnerable Software and Affected Versions @fastify/bearer-auth versions prior to 7.0.2 and 8.0.1 fastify-bearer-auth versions 5.0.1 through 6.0.3 Description The issue is related to the insecure use of crypto.timingSafeEqual in @fastify/bearer-auth, allowing a malicious attacker to...