8.7
High
CVE-2024-47178 basic-auth-connect is Connect's Basic Auth middleware in its own module
Description
basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| basic-auth-connect 1.1 | earliest → < 1.1.0 | 1.1.0 |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified