CVE-2026-21713: 
npm vulnerability analysis and mitigation

CVE-2026-21713 is a timing side-channel vulnerability in Node.js HMAC verification, where crypto_hmac.cc uses a non-constant-time memcmp() comparison when validating user-provided signatures. This flaw leaks timing information proportional to the number of matching bytes, enabling a timing oracle attack to infer HMAC values under conditions where high-resolution timing measurements are feasible. It affects Node.js versions 20.x, 22.x, 24.x, and 25.x. The vulnerability was disclosed on March 30, 2026, and carries a CVSS v3.0 base score of 5.9 (Medium) (Node.js Advisory, GitHub Advisory).

The root cause is classified as CWE-208 (Observable Timing Discrepancy). In crypto_hmac.cc, the HMAC digest comparison uses memcmp(), which short-circuits on the first differing byte, causing execution time to vary based on how many bytes of the attacker-supplied signature match the expected value. This behavior creates a timing oracle: an attacker can iteratively probe byte values and use response timing to determine correct HMAC bytes. Notably, Node.js already exposes crypto.timingSafeEqual() — a constant-time comparison primitive used elsewhere in the codebase — making this an oversight rather than an intentional design choice. The vulnerability was reported by researcher x_probe and fixed by panva (Node.js Advisory, GitHub Advisory).

Successful exploitation could allow a remote, unauthenticated attacker to incrementally recover valid HMAC signatures used for authentication or integrity verification in Node.js applications. The primary impact is a high confidentiality risk — specifically, the potential compromise of HMAC-based authentication mechanisms, which could enable MAC forgery, session token inference, or bypass of integrity checks. Availability and integrity are not directly impacted by this vulnerability (Node.js Advisory, GitHub Advisory).

1. Identify target endpoint: Locate a Node.js application (versions 20.x, 22.x, 24.x, or 25.x) that performs HMAC verification on attacker-controlled input, such as a webhook signature validator or API authentication endpoint.
2. Establish high-resolution timing baseline: Use a network-adjacent or local position to minimize jitter, and establish a baseline for response times using a known-invalid HMAC to calibrate measurement precision.
3. Iterative byte probing: For each byte position in the HMAC, send requests with all 256 possible byte values while holding other bytes constant. Measure response times for each candidate — the value that produces the longest response time (due to memcmp() matching more bytes before short-circuiting) is the correct byte.
4. Repeat across all bytes: Repeat step 3 for each subsequent byte position, building up the correct HMAC value incrementally.
5. Forge HMAC: Use the recovered HMAC value to craft authenticated requests, bypassing integrity or authentication checks in the target application (Node.js Advisory, GitHub Advisory).

Node.js has released patched versions addressing this vulnerability: 20.20.1 (and later 20.20.2), 22.22.1 (and later 22.22.2), 24.14.0 (and later 24.14.1), and 25.8.1 (and later 25.8.2). The fix replaces the non-constant-time memcmp() comparison in crypto_hmac.cc with the existing crypto.timingSafeEqual() primitive. Organizations should upgrade to the patched versions as the primary remediation. As a temporary workaround, applications can implement their own HMAC comparison using crypto.timingSafeEqual() at the application layer until the Node.js runtime is updated. IBM API Connect users should also apply the vendor-specific patch documented in IBM's advisory (Node.js Advisory, IBM Advisory, Microsoft Advisory).

The Node.js project disclosed this vulnerability as part of a broader March 2026 security release that addressed nine CVEs across four active release lines, with community coverage noting the breadth of the release (Node.js Advisory). Security news outlets including CyberSecurityNews, GBHackers, and The Cyber Express covered the Node.js security release, though coverage focused primarily on the higher-severity DoS vulnerabilities (CVE-2026-21637, CVE-2026-21710) rather than CVE-2026-21713 specifically. The oss-sec mailing list also carried a disclosure entry for this vulnerability (oss-sec). Downstream Linux distributions including Red Hat, Debian, openSUSE, Rocky Linux, AlmaLinux, Amazon Linux, and Mageia have all issued updated packages incorporating the fix.