AIKIDO-2026-418574
mercadopago is vulnerable to Denial of Service (DoS)
20
Low Risk
This Affects:
mercadopagoTL;DR
The SDK's WebhookSignatureValidator compares the received signature against the computed HMAC using the JavaScript string length before calling crypto.timingSafeEqual. A signature header whose character length matches the expected value but whose byte length differs, for example one containing multibyte characters, passes the length check and makes timingSafeEqual throw an uncaught RangeError. This crashes processing of the incoming webhook request, letting untrusted callers disrupt webhook handling. The fix compares the byte length of both values with Buffer.byteLength before the constant-time comparison.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the SDK's webhook signature validation to verify incoming MercadoPago webhook notifications.
Background info
mercadopago is vulnerable to Denial of Service (DoS) in versions 2.13.0 - 3.2.1.
How to fix this
Upgrade the mercadopago library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant