AIKIDO-2025-10971

TL;DR

Affected versions of this package before the implementation of BREACH attacks mitigations were vulnerable to compression side-channel attacks; an attacker could exploit this by repeatedly submitting crafted requests containing guessable payloads to an endpoint that reflected user secrets (like a CSRF token) in its compressed response body, and then analyzing the variations in the resulting encrypted response sizes to successfully deduce those secret values character by character.