AIKIDO-2026-10072
grammy is vulnerable to Timing Attacks
45
Medium Risk
This Affects:
grammyTL;DR
Affected versions of this package are vulnerable to timing attacks due to non-constant-time string comparison when validating secret tokens, which can allow an attacker to infer secret token information through timing differences; the issue is fixed by replacing the vulnerable logic with a constant-time, byte-by-byte comparison that always iterates tokenBytes.length times, prevents timing-based information leakage, and correctly handles undefined and edge cases.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
grammy is vulnerable to Timing Attacks in versions 1.9.0 - 1.39.2.
How to fix this
Upgrade the grammy library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant