@perfood/couch-auth has a host header injection vulnerability

CRITICAL 9.3CVE-2025-70948 · GHSA-qw8v-34ww-6q9p · Published 05/03/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
@perfood/couch-auth npm	`≤ 0.26.0`	No fix yet

Description

A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header.

NVD description

A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header.

References

nvd.nist.gov/vuln/detail/CVE-2025-70948 · ADVISORY
gist.github.com/0xHunterr/38aab644874ca9f4646524c5b01cfe5e · WEB
perfood/couch-auth · PACKAGE
npmjs.com/package/@perfood/couch-auth · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free