Timing Attack Affecting tailscale.com/types/key package, versions <1.86.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-TAILSCALECOMTYPESKEY-10361582
- published22 Jul 2025
- disclosed22 May 2025
- creditUnknown
Introduced: 22 May 2025
CVE NOT AVAILABLE CWE-208 Â (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade tailscale.com/types/key to version 1.86.0 or higher.
Overview
Affected versions of this package are vulnerable to Timing Attack due to an insecure non-constant time comparison in DERP server mesh authentication.
Note: All Tailscale-operated DERP servers and Tailscale users who operate their own custom DERP servers with more than one server per region are affected.