Executive brief
secure-compare is a Node.js library used to safely compare strings in applications, typically for authentication or token validation. A vulnerability in versions before 3.0.1 causes the library to always return true when comparing strings of equal length, regardless of their actual content. This completely bypasses security checks, allowing attackers to forge or spoof credentials that pass string validation.
Technical details
The vulnerability is an insecure comparison flaw (CWE-697) in the secure-compare library. The root cause was a logic error where the comparison function was comparing a variable with itself rather than comparing the two input strings, causing it to always return true for strings of equal length. This affects all versions prior to 3.0.1. The attack vector is local or application-level—any code using this library for security-critical string comparisons is affected. An attacker can craft forged credentials or tokens that are the same length as expected values and bypass authentication. The fix is available in version 3.0.1 and later.
Affected products
- npm secure-compare before 3.0.1
Timeline
- 2015-03-30: disclosed: Fix merged in upstream repository
- 2019-06-03: advisory: GHSA published