express-basic-auth is a simple plug & play HTTP basic auth middleware for Express.
Affected versions of this package are vulnerable to Timing Attack
due to it using native string compare for passwords, as oppose to comparing with a set constant time.
Upgrade express-basic-auth to version 1.1.7 or higher.
GitHub Suggested PR