Description
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
Remediation
References
https://github.com/vdemedes/secure-compare/pull/1
https://nodesecurity.io/advisories/50
Related Vulnerabilities
CVE-2022-40764 Vulnerability in npm package snyk-go-plugin
CVE-2022-36437 Vulnerability in maven package com.hazelcast:hazelcast
CVE-2023-46589 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2021-21317 Vulnerability in npm package uap-core
CVE-2022-40955 Vulnerability in maven package org.apache.inlong:sort-connector-mysql-cdc