← All advisories

Medium severity4.4NVD Advisory· Published Nov 19, 2019· Updated Jun 17, 2026

CVE-2016-1000236

CVE-2016-1000236

Description

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
cookie-signaturenpm	< 1.0.4	1.0.4

Affected products

5

node-cookie-signature/cookie-signaturedescription
ghsa-coords
pkg:npm/cookie-signature
Range: < 1.0.4
Cookie Signature Project/Cookie Signature
cpe:2.3:a:cookie-signature_project:cookie-signature:*:*:*:*:*:node.js:*:*
Range: <1.0.6
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

13

bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchThird Party AdvisoryWEB
bugzilla.redhat.com/show_bug.cginvdIssue TrackingPatchThird Party AdvisoryWEB
security-tracker.debian.org/tracker/CVE-2016-1000236nvdPatchThird Party AdvisoryWEB
bugs.debian.org/cgi-bin/bugreport.cginvdIssue TrackingThird Party AdvisoryWEB
github.com/advisories/GHSA-92vm-wfm5-mxvvghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2016-1000236ghsaADVISORY
travis-ci.com/nodejs/security-wg/builds/76423102nvdThird Party AdvisoryWEB
github.com/tj/node-cookie-signature/commit/2c4df6b6cee540f30876198cd0b5bebf28528c07ghsaWEB
github.com/tj/node-cookie-signature/commit/39791081692e9e14aa62855369e1c7f80fbfd50eghsaWEB
github.com/tj/node-cookie-signature/commit/4cc5e21e7f59a4ea0b51cd5e9634772d48fab590ghsaWEB
www.mail-archive.com/[email protected]/msg06583.htmlghsaWEB
www.npmjs.com/advisories/134ghsaWEB
www.mail-archive.com/secure-testing-team%40lists.alioth.debian.org/msg06583.htmlnvd

News mentions

0

No linked articles in our index yet.