Description
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
Remediation
References
https://github.com/vdemedes/secure-compare/pull/1
https://nodesecurity.io/advisories/50
Related Vulnerabilities
CVE-2019-1003032 Vulnerability in maven package org.jenkins-ci.plugins:email-ext
CVE-2020-8141 Vulnerability in maven package org.webjars.bowergithub.olado:dot
CVE-2020-10650 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2018-19827 Vulnerability in maven package org.webjars.npm:node-sass
CVE-2019-12419 Vulnerability in maven package org.apache.cxf:cxf-rt-rs-security-sso-oidc