Name of the Vulnerable Software and Affected Versions express-basic-auth versions prior to 1.1.7

Description The issue concerns the use of native string comparison instead of a constant time string comparison in the express-basic-auth package. This can lead to timing attacks, which may increase the efficiency of brute-force attacks by reducing the entropy gained from longer secrets.

Recommendations Upgrade to version 1.1.7 or later.