IA Squad
PT
js · nocodbHeads-up

NocoDB: Timing-safe password verification for shared views

The shared-view password check in View.

09 Jun 2026Read 1 minSeverity: schedule it

What changed

The shared-view password check in View.ts and the EE dashboard model's verifyPassword now use crypto.timingSafeEqual and a same-length dummy compare on the length-mismatch path, replacing the legacy strict-equality (===) comparison that leaked password length and per-character prefix through response timing.

Who it affects

Users of NocoDB with shared views that have passwords predating the bcrypt migration, and any network-positioned attacker who can time shared-view authentication responses.

What to do today

Update NocoDB to the patched version to eliminate the timing side-channel vulnerability in shared-view password verification.

The trail
Collected Audited Written Published