CRITICAL9.3

GHSA-qw8v-34ww-6q9p

@perfood/couch-auth has a host header injection vulnerability

Details

A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@perfood/couch-auth

Introduced in: 0

No fixed version published yet for @perfood/couch-auth (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-70948[ADVISORY]
https://gist.github.com/0xHunterr/38aab644874ca9f4646524c5b01cfe5e[WEB]
https://github.com/perfood/couch-auth[PACKAGE]
https://www.npmjs.com/package/@perfood/couch-auth[WEB]