Insecure Comparison in secure-compare

MOYENNE 5.3CVE-2015-9238 · GHSA-h9x2-5rm7-x4gm · Published 31/05/2018 · updated 17/06/2026

En bref

CVE-2015-9238 est une vulnérabilité MOYENNE (CVSS 5.3) touchant secure-compare (secure-compare project), secure-compare.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.5%, plus élevée que 74.0% des vulnérabilités.
Correctif : mettre à jour vers 3.0.1 ou plus récent.

Package	Affected versions	Patched versions
secure-compare secure-compare_project	`< 3.0.1`	`3.0.1`
secure-compare npm	`< 3.0.1`	`3.0.1`

Description

Versions of secure-compare prior to 3.0.1 are affected by a vulnerability that results in the package always returning true when comparing two strings of the same length, despite differences in the contents of those strings.

Recommendation

Upgrade to version 3.0.1 or later.

NVD description

secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

References

nvd.nist.gov/vuln/detail/CVE-2015-9238 · ADVISORY
vdemedes/secure-compare#1 · WEB
vadimdemedes/secure-compare commit dd1ff1a · WEB
npmjs.com/advisories/50 · WEB
nodesecurity.io/advisories/50 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free