Skip to content
OpenAdvisories

Package · npm

@perfood/couch-auth

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • High 7.5
    CVE-2025-70949

    @perfood/couch-auth has an Observable Timing Discrepancy

    An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.

    @perfood/couch-auth npm
  • Critical 9.3
    CVE-2025-70948

    @perfood/couch-auth has a host header injection vulnerability

    A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header.

    @perfood/couch-auth npm
  • Medium 6.5
    CVE-2025-60794

    @perfood/couch-auth may expose session tokens, passwords

    Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging …

    @perfood/couch-auth npm
  • High 7.3
    CVE-2024-57177

    CouchAuth has a Server-Side Template Injection vulnerability in its email functionality

    A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited comman…

    @perfood/couch-auth npm
  • Critical 9.6
    CVE-2023-39655

    CouchAuth host header injection vulnerability leaks the password reset token

    A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead t…

    @perfood/couch-auth npm