expressjs basic-auth-connect vulnerabilities

Latest expressjs basic-auth-connect CVEs

Newest publication first

1. CVE-2024-47178 basic-auth-connect's callback uses time unsafe string comparison

   Published 2024-09-30

   High·CVSS 8.7

   basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.