AIKIDO-2026-10141
@csrf-armor/core is vulnerable to Observable Timing Discrepancy
27
Low Risk
This Affects:
@csrf-armor/coreTL;DR
Affected versions of this package contain CSRF token validation logic vulnerable to timing side-channel attacks due to non-constant time comparisons and weak secret generation. An attacker could exploit subtle response timing differences when comparing CSRF tokens to iteratively infer valid token values, enabling CSRF bypass or unauthorized state-changing requests. Additionally, low-entropy, improperly encoded secrets reduce brute-force resistance, compounding the risk when combined with timing analysis.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@csrf-armor/core is vulnerable to Observable Timing Discrepancy in versions 0.0.1 - 1.2.0.
How to fix this
Upgrade the @csrf-armor/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant