cve: POSTCUT-003
alias: JWT timing oracle — early-exit string compare leaks signature bytes
cwe_primary: CWE-208
cwe_acceptable: [CWE-208, CWE-203, CWE-385, CWE-1254, CWE-310]
target_file: source.js
vuln_lines: [9, 10, 11, 12, 13, 14, 15]
severity: high
vuln_class: timing_attack
exploit_pattern_regex: '(timing\s*attack|side[- ]channel|early[- ]exit|byte[- ]by[- ]byte|timing\s*oracle|crypto\.timingSafeEqual)'
must_mention_any:
  - timing attack
  - timing oracle
  - early exit
  - early-out
  - short-circuit
  - byte-by-byte
  - timingSafeEqual
  - side channel
  - timing side
  - character.code
points: 30
memorization_resistant: true
notes: |
  Synthetic — novel. The "timingSafeStr" function is NOT timing-safe: it
  returns on the first mismatched byte. Attacker can recover the expected
  HMAC one byte at a time by measuring response time over the network.
  Fix: use crypto.timingSafeEqual on equal-length buffers.