WS-2017-0266 | Mend Vulnerability Database

Vulnerability DatabaseWS-2017-0266

WS-2017-0266

Published:May 14, 2026

Updated:May 14, 2026

http-signature before version 1.0.0 are vulnerable to timing attack, which may lead to information disclosure.

Affected Packages

nodejs (CONDA):

Affected version(s) =4.2.6 <4.4.1

Fix Suggestion:

Update to version 4.4.1

azure-cli (CONDA):

Affected version(s) =0.10.3

Fix Suggestion:

Update to version no_fix

http-signature (NPM):

Affected version(s) >=0.9.0 <1.0.0

Fix Suggestion:

Update to version 1.0.0

nodelesstesttwo (NUGET):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

jetbrains.rider.frontend5 (NUGET):

Affected version(s) >=203.0.20201028.165436-eap05 <211.0.20210422.120959

Fix Suggestion:

Update to version 211.0.20210422.120959

ncapsulate.node.shadow (NUGET):

Affected version(s) =5.3.0

Fix Suggestion:

Update to version no_fix

jetbrains.rider.frontend4 (NUGET):

Affected version(s) >=203.0.20201001.140309-eap02 <203.0.20201028.165436-eap05

Fix Suggestion:

Update to version 203.0.20201028.165436-eap05

nodeless2 (NUGET):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

betclic.buildtools.node (NUGET):

Affected version(s) >=1.0.0 <1.0.6

Fix Suggestion:

Update to version 1.0.6

pvc.browserify (NUGET):

Affected version(s) =0.0.1 <0.0.1.1

Fix Suggestion:

Update to version 0.0.1.1

dotlessbuildtasksdotnet (NUGET):

Affected version(s) >=2.0.0 <=2.1.7-rc1

Fix Suggestion:

Update to version no_fix

npm (NUGET):

Affected version(s) >=1.4.4 <=3.5.2

Fix Suggestion:

Update to version no_fix

node-sass-bundle (NUGET):

Affected version(s) >=1.0.3 <=1.1.0

Fix Suggestion:

Update to version no_fix

winless.lessc (NUGET):

Affected version(s) =1.0.14

Fix Suggestion:

Update to version no_fix

nodelesstest (NUGET):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

nc.frontend.env (NUGET):

Affected version(s) =1.0.3

Fix Suggestion:

Update to version no_fix

nodeint (NUGET):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

jetbrains.rider.frontend4 (NUGET):

Affected version(s) =211.0.20210316.154439-eap08 <211.0.20210324.212621-eap09

Fix Suggestion:

Update to version 211.0.20210324.212621-eap09

nodeenv (NUGET):

Affected version(s) >=1.0.0 <=1.0.2

Fix Suggestion:

Update to version no_fix

npm3 (NUGET):

Affected version(s) =3.0.0-alpha0001

Fix Suggestion:

Update to version no_fix

jetbrains.rider.frontend5 (NUGET):

Affected version(s) >=202.0.20200810.195204 <203.0.20201001.140309-eap02

Fix Suggestion:

Update to version 203.0.20201001.140309-eap02

ncapsulate.node (NUGET):

Affected version(s) >=0.10.26 <=0.10.35.1

Fix Suggestion:

Update to version no_fix

pvc.runtime.nodejs (NUGET):

Affected version(s) >=0.0.1 <=0.0.1.5

Fix Suggestion:

Update to version no_fix

ncapsulate.bower (NUGET):

Affected version(s) >=1.3.2 <=1.3.12.1

Fix Suggestion:

Update to version no_fix

yeoman (NUGET):

Affected version(s) =1.1.2

Fix Suggestion:

Update to version no_fix

nodebin (NUGET):

Affected version(s) =5.2.0

Fix Suggestion:

Update to version no_fix

bower (NUGET):

Affected version(s) >=1.2.7 <=1.3.11

Fix Suggestion:

Update to version no_fix

node-sass-bundle (NUGET):

Affected version(s) >=1.0.0 <1.0.2

Fix Suggestion:

Update to version 1.0.2

jetbrains.rider.frontend5 (NUGET):

Affected version(s) >=211.0.20210324.212621-eap09 <213.0.20211008.154703-eap03

Fix Suggestion:

Update to version 213.0.20211008.154703-eap03

npm.js (NUGET):

Affected version(s) >=1.3.15 <=2.13.1

Fix Suggestion:

Update to version no_fix

nodeless (NUGET):

Affected version(s) >=1.0.0 <=1.0.4

Fix Suggestion:

Update to version no_fix

adrexia/silverstripe-pure (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

mpcmf/mpcmf-web-app (PHP):

Affected version(s) =dev-master <1.0.0.x-dev

Fix Suggestion:

Update to version 1.0.0.x-dev

lukesnowden/application-base (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

dreamfactory/df-api-docs-ui (PHP):

Affected version(s) >=1.0.0 <1.1.0

Fix Suggestion:

Update to version 1.1.0

hydrawiki/lessoid (PHP):

Affected version(s) =2.0.2

Fix Suggestion:

Update to version no_fix

yuan1994/wechat_web_devtools (PHP):

Affected version(s) >=0.10.102800 <0.15.152901

Fix Suggestion:

Update to version 0.15.152901

hydrawiki/lessoid (PHP):

Affected version(s) >=dev-develop <2.0.0

Fix Suggestion:

Update to version 2.0.0

mpcmf/mpcmf-web-app (PHP):

Affected version(s) =dev-php7

Fix Suggestion:

Update to version no_fix

neon-sys (RUST):

Affected version(s) >=0.0.7 <0.1.10

Fix Suggestion:

Update to version 0.1.10

nanny-sys (RUST):

Affected version(s) >=0.0.1 <=0.0.6

Fix Suggestion:

Update to version no_fix

ears (RUST):

Affected version(s) =0.3.3 <0.3.4

Fix Suggestion:

Update to version 0.3.4

Related Resources (2)

https://github.com/joyent/node-http-signature/pull/36

https://github.com/joyent/node-http-signature/commit/78ab1da232f31f695f5c362d863593a143aa8b56

Do you need more information?

CVSS v4

Base Score:

5.1

Attack Vector

ADJACENT

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

LOW

Vulnerable System Integrity

NONE

Vulnerable System Availability

NONE

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

3.5

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE