Description
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
Remediation
References
https://github.com/vdemedes/secure-compare/pull/1
https://nodesecurity.io/advisories/50
Related Vulnerabilities
CVE-2019-10403 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2021-31811 Vulnerability in maven package org.apache.pdfbox:pdfbox
CVE-2019-10405 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2022-29166 Vulnerability in npm package matrix-org-irc
CVE-2021-4245 Vulnerability in maven package org.webjars.npm:rfc6902