{"action":"Upgrade express-basic-auth to 1.1.7 or later.","affected":[{"fixed":"1.1.7","introduced":"0"}],"component":"express-basic-auth","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.1.7"],"ghsa_id":"GHSA-c35v-qwqg-87jc","id":"tcs_01M5KFHHPY4VZ3PKW8Z8YW17NA","modified_at":"2022-08-03T16:27:53Z","published_at":"2019-06-06T15:32:32Z","references":["https://osv.dev/vulnerability/GHSA-c35v-qwqg-87jc","https://github.com/webpack-contrib/webpack-bundle-analyzer/issues/263","https://github.com/LionC/express-basic-auth/pull/20","https://github.com/LionC/express-basic-auth/pull/21","https://github.com/LionC/express-basic-auth/commit/00bb29fdd638f5cda8025d4398be97d528ce3f6f","https://github.com/LionC/express-basic-auth","https://snyk.io/vuln/SNYK-JS-EXPRESSBASICAUTH-174345","https://www.npmjs.com/advisories/827"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"GHSA-c35v-qwqg-87jc","url":"https://osv.dev/vulnerability/GHSA-c35v-qwqg-87jc"}],"summary":"express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison"}