@perfood/couch-auth has a host header injection vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-70948 · ADVISORY
• gist.github.com/0xHunterr/38aab644874ca9f4646524c5b01cfe5e · WEB
• perfood/couch-auth · PACKAGE
• npmjs.com/package/@perfood/couch-auth · WEB

Weitere Schwachstellen in @perfood/couch-auth

• CVE-2025-70949HOCH 7.5An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.
• CVE-2025-60794MITTEL 6.5Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/use…
• CVE-2024-57177HOCH 7.3A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header …
• CVE-2023-39655KRITISCH 9.6A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host …