CVE-2015-9238 | BDVDB-2026-101320 Detail

HackerOnesecure-compare node module

Description#

secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-697 Incorrect Comparison (CWE-697)

References#

https://github.com/vdemedes/secure-compare/pull/1
https://nodesecurity.io/advisories/50

Exploit#

No public exploit known

History#

Version 12018-05-31Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.