CVE-2026-21713

score

<0.1

cvss

5.9

epss

0.4%

published

2026-03-30

kev added

—

first seen

2026-10-21

Node.js 20.x, 22.x, 24.x, and 25.x contain a timing attack vulnerability caused by non-constant-time HMAC verification, letting attackers infer HMAC values via timing oracle, exploit requires high-resolution timing measurements.