CVE-2016-10535: Timing Attack in csrf-lite
Summary
CVE-2016-10535: Timing Attack in csrf-lite. Affects csrf-lite versions < 0.1.2. Fixed in 0.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The csrf-lite package is an npm package that provides Cross-Site Request Forgery (CSRF) protection for web applications. It is designed to generate and validate CSRF tokens to prevent unauthorized requests. However, certain versions of csrf-lite are vulnerable to a timing attack.
Vulnerability Detail
The vulnerability in csrf-lite arises from the use of a fail-early comparison instead of a constant-time comparison when testing CSRF tokens. This allows an attacker to exploit timing differences and guess the secret token more efficiently. By providing per-character feedback on the correctness of a guess, an attacker can significantly reduce the number of guesses required to guess the secret token.
How To Fix
Latest published version: 1.0.0 as of 22 Oct 2026
npm install csrf-lite@1.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.2
This is the first release that contains the fix.
npm install csrf-lite@0.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The csrf-lite package is vulnerable to a timing attack, which allows an attacker to guess the secret CSRF token more efficiently. To fix this vulnerability, it is recommended to update to version 0.1.2 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for csrf-lite →
FAQ
The vulnerability allows an attacker to guess the secret CSRF token more efficiently, potentially leading to unauthorized requests and security breaches.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and it will alert you in real-time if the vulnerability is present.
No, only versions prior to 0.1.2 are affected. It is recommended to update to version 0.1.2 or later to fix the vulnerability.
There is no known public exploit for this vulnerability at the moment.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-hjhr-r3gq-qvp6/GHSA-hjhr-r3gq-qvp6.json).
