AIKIDO-2026-10015
bcrypt is vulnerable to Observable Timing Discrepancy
28
Low Risk
This Affects:
bcryptTL;DR
Affected versions of this package are vulnerable to Timing Attacks due to a non-constant time string comparison in the == method for password hash verification (the original code used super, which is typically a regular equality check). An attacker could exploit this by analyzing the time taken to compare a guessed secret against the stored hash to infer information about the hash and potentially brute-force the password more efficiently. The patched code implements a constant-time comparison by iterating through each byte and using a bitwise OR operation, ensuring the comparison time does not depend on the input.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
bcrypt is vulnerable to Observable Timing Discrepancy in versions 3.1.0 - 3.1.20.
How to fix this
Upgrade the bcrypt library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant