CVE-2026-21713: Node.js Timing Attack Vulnerability

CVE-2026-21713 Overview

A timing attack vulnerability has been identified in Node.js HMAC verification that uses a non-constant-time comparison when validating user-provided signatures. This flaw potentially leaks timing information proportional to the number of matching bytes during HMAC validation. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values, compromising cryptographic authentication mechanisms.

Notably, Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.

Critical Impact

Attackers with the ability to perform high-resolution timing measurements could potentially exploit this vulnerability to recover HMAC signatures through timing analysis, leading to authentication bypass or message forgery.

Affected Products

• Node.js 20.x
• Node.js 22.x
• Node.js 24.x
• Node.js 25.x

Discovery Timeline

• 2026-03-30 - CVE CVE-2026-21713 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-21713

Vulnerability Analysis

This vulnerability represents a classic timing side-channel attack vector in cryptographic operations. The core issue lies in the HMAC signature verification routine, which performs a byte-by-byte comparison that terminates early upon finding a mismatch. This implementation allows an attacker to measure response times and deduce information about the expected HMAC value.

When comparing two byte sequences, a non-constant-time comparison will return faster when the first differing byte is encountered earlier in the sequence. By systematically varying the input and measuring response latencies, an attacker can incrementally discover the correct HMAC signature one byte at a time, significantly reducing the computational complexity of a brute-force attack.

The attack requires the ability to make repeated authentication attempts while accurately measuring timing differences, which may be as small as nanoseconds. While network latency typically introduces noise, local attackers or those with low-latency network access may still exploit this vulnerability successfully.

Root Cause

The root cause is the use of a standard equality comparison operator for HMAC validation rather than a constant-time comparison function like crypto.timingSafeEqual(). Standard comparison functions are optimized for performance and short-circuit upon finding a mismatch, inadvertently creating a timing oracle. Node.js provides crypto.timingSafeEqual() specifically to prevent such timing leaks, but this function was not used consistently throughout the HMAC verification code paths.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker would need to:

1. Identify an endpoint that performs HMAC signature verification
2. Submit requests with varying HMAC signatures while precisely measuring response times
3. Analyze timing differences to determine which bytes of the submitted signature match the expected value
4. Iterate through byte positions to reconstruct the full valid HMAC signature
5. Use the recovered signature to forge authenticated requests

The vulnerability manifests in the HMAC comparison routine where a non-constant-time string comparison is used instead of crypto.timingSafeEqual(). Exploitation requires the attacker to submit numerous requests while measuring response latencies with sufficient precision to detect timing differences caused by early comparison termination. For detailed technical information, refer to the Node.js March 2026 Security Release Blog.

Detection Methods for CVE-2026-21713

Indicators of Compromise

• Unusual patterns of repeated authentication requests with incrementally varying HMAC signatures
• High volume of failed authentication attempts from a single source targeting HMAC-protected endpoints
• Requests exhibiting statistical patterns consistent with timing oracle attacks (sequential byte probing)

Detection Strategies

• Implement rate limiting and anomaly detection on authentication endpoints to identify potential timing attack attempts
• Monitor for unusual patterns of failed HMAC verification attempts that show systematic variation in submitted signatures
• Deploy application-level logging to track authentication failures and correlate with timing analysis patterns
• Review Node.js application code for any custom HMAC verification that may also use non-constant-time comparisons

Monitoring Recommendations

• Enable verbose logging on HMAC-protected API endpoints to capture authentication attempt metadata
• Implement real-time alerting for high-frequency authentication failures from individual IP addresses or user sessions
• Monitor network traffic for patterns indicative of automated probing against authentication endpoints
• Conduct periodic security audits of cryptographic code paths to ensure consistent use of timing-safe operations

How to Mitigate CVE-2026-21713

Immediate Actions Required

• Update Node.js to the latest patched version for your release line (20.x, 22.x, 24.x, or 25.x)
• Review custom application code that performs HMAC verification and ensure it uses crypto.timingSafeEqual() for all comparisons
• Implement rate limiting on authentication endpoints to reduce the feasibility of timing attacks
• Consider adding random delays to authentication responses as a defense-in-depth measure

Patch Information

The Node.js security team has released patches addressing this timing vulnerability in all affected release lines. Users should upgrade to the latest security release for their respective branches. For complete patch details and download links, refer to the Node.js March 2026 Security Release Blog.

Workarounds

• If immediate patching is not possible, implement application-level rate limiting on HMAC-protected endpoints to limit timing measurement opportunities
• Add artificial random delays to authentication responses to introduce noise that makes timing measurements less reliable
• Replace any direct HMAC comparison code in your application with explicit calls to crypto.timingSafeEqual() to ensure constant-time comparison
• Consider deploying a reverse proxy with built-in timing attack mitigations in front of affected applications

# Example: Using crypto.timingSafeEqual() for secure HMAC comparison in Node.js
# Replace standard equality checks with timing-safe comparison:
# const crypto = require('crypto');
# const isValid = crypto.timingSafeEqual(Buffer.from(expectedHmac), Buffer.from(providedHmac));