Skip to content

Product

npm secure-compare vulnerabilities

1 published CVE affecting npm secure-compare, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
0
High
0
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest npm secure-compare CVEs

Newest publication first

  1. CVE-2015-9238 Insecure Comparison in secure-compare

    Published
    MediumCVSS 5.3 EPSS 1.4%

    secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.