Advisory Weakness Curation

express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison Versions of `express-basic-auth` prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets. ## Recommendation Upgrade to version 1.1.7 or later.

Timing Attack in express-basic-auth Versions of `express-basic-auth` are vulnerable to Timing Attacks. The package uses nating string comparison instead of a constant time string compare which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.