CVE-2024-47178

CVE-2024-47178 is a timing-unsafe equality comparison vulnerability in the basic-auth-connect middleware (versions prior to 1.1.0) used with Express.js. This flaw could allow an attacker to glean timing information, potentially aiding in brute-force attacks against authentication credentials. Rated as Medium severity (CVSS 5.3), it requires no user interaction and has low impact on confidentiality, with no integrity or availability impact. Currently, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this vulnerability.