@perfood/couch-auth has an Observable Timing Discrepancy

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-70949 · ADVISORY
• gist.github.com/0xHunterr/38aab644874ca9f4646524c5b01cfe5e · WEB
• perfood/couch-auth · PACKAGE
• npmjs.com/package/@perfood/couch-auth · WEB

More vulnerabilities in @perfood/couch-auth

• CVE-2025-70948CRITICAL 9.3A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and exe…
• CVE-2025-60794MEDIUM 6.5Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/use…
• CVE-2024-57177HIGH 7.3A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header …
• CVE-2023-39655CRITICAL 9.6A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host …