CVE-2016-10535

CVE-2016-10535 affects the csrf-lite library, a cross-site request forgery protection for Node.js applications. The vulnerability stems from its use of a fail-first string comparison (===) instead of a time-constant comparison, making it susceptible to a timing attack. This significantly reduces the number of guesses an attacker needs to determine the secret, from 16^18 to approximately 288. Rated as MEDIUM severity (CVSS 5.9), it has a network attack vector and high confidentiality impact, but requires high attack complexity. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.