AIKIDO-2026-538693
@adyen/api-library is vulnerable to Denial of Service (DoS)
30
Low Risk
This Affects:
@adyen/api-libraryTL;DR
The library validates HMAC signatures for webhook notifications and Terminal API (Nexo) messages using Node's crypto.timingSafeEqual. In NexoCrypto.validateHmac and the related HMAC comparison, timingSafeEqual is called without first checking that the computed and received HMAC buffers have the same length. A tampered message carrying a truncated or malformed HMAC makes timingSafeEqual throw an unhandled TypeError instead of returning a controlled validation failure, disrupting signature verification. The fix adds a length check before timingSafeEqual so a length mismatch is treated as an invalid HMAC and raises the expected NexoCryptoException.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the library's HMAC validation for webhooks or Terminal API (Nexo) messages.
Background info
@adyen/api-library is vulnerable to Denial of Service (DoS) in versions 8.0.0 - 31.0.0.
How to fix this
Upgrade the @adyen/api-library library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant