AIKIDO-2026-10973
@slack/bolt is vulnerable to Improper Authentication
74
High Risk
This Affects:
@slack/boltTL;DR
The Bolt framework verifies incoming Slack HTTP requests with an HMAC keyed by signingSecret when signatureVerification is enabled. Previously, an empty or missing secret still initialized receivers and ran createHmac with an empty key, so an attacker could forge valid X-Slack-Signature headers and submit arbitrary Events API payloads. Apps that set signingSecret to an empty string or relied on receiver defaults could accept spoofed events without warning. The patch rejects empty, null, or undefined secrets whenever verification is enabled and adds shared validation in request verification.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@slack/bolt is vulnerable to Improper Authentication in versions 1.0.0 - 4.7.2.
How to fix this
Upgrade the @slack/bolt library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant