GHSA-gq3j-xvxp-8hrf: Hono added timing comparison hardening in basicAuth and bearerAuth
The basicAuth and bearerAuth middlewares previously used a comparison that was not fully timing-safe.
The timingSafeEqual function used normal string equality (===) when comparing hash values. This comparison may stop early if values differ, which can theoretically cause small timing differences.
The implementation has been updated to use a safer comparison method.
References
Code Behaviors & Features
Detect and mitigate GHSA-gq3j-xvxp-8hrf with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →