CVE-2022-31142

CVE-2022-31142 is a high-severity vulnerability affecting the @fastify/bearer-auth and fastify-bearer-auth plugins, which are used to enforce bearer Authorization headers. The vulnerability stems from an insecure implementation of crypto.timingSafeEqual, allowing an attacker to estimate the length of a valid bearer token, thereby aiding in brute-force attacks due to the limited character set of base64 tokens. With a CVSS score of 7.5 (HIGH), this vulnerability has a low attack complexity and requires no user interaction, making it easily exploitable over the network to achieve high confidentiality impact. While there are no known workarounds, patched versions 7.0.2 and 8.0.1 of @fastify/bearer-auth address the issue. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, which is typical for the majority of vulnerabilities.