CVE-2021-29444

CVE-2021-29444 describes a padding oracle vulnerability in the jose-browser-runtime npm package, specifically affecting versions prior to 3.11.4. This flaw in the AES_CBC_HMAC_SHA2 decryption algorithm could allow an attacker to discern timing differences during padding errors, potentially leading to the decryption of sensitive data without the encryption key. Rated as Medium severity (CVSS 5.9), the vulnerability has a network attack vector and high impact on confidentiality, though it requires high attack complexity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.