Timing Attack Affecting tailscale.com/cmd/derper package, versions <1.86.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-TAILSCALECOMCMDDERPER-10361579
- published22 Jul 2025
- disclosed22 May 2025
- creditUnknown
Introduced: 22 May 2025
CVE NOT AVAILABLE CWE-208 Â (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade tailscale.com/cmd/derper to version 1.86.0 or higher.
Overview
Affected versions of this package are vulnerable to Timing Attack due to an insecure non-constant time comparison in DERP server mesh authentication.
Note: All Tailscale-operated DERP servers and Tailscale users who operate their own custom DERP servers with more than one server per region are affected.