MEDIUM
GHSA-62vx-hpcr-m9ch
@perfood/couch-auth may expose session tokens, passwords
Details
Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/@perfood/couch-auth
Introduced in:
0No fixed version published yet for @perfood/couch-auth (npm). Pin to a known-safe version or switch to an alternative.