CVE-2025-70949
An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.
Veröffentlicht Aktualisiert
PatchFirst · Aktuelle Sicherheitslücken
Sicherheitslücken in @perfood/couch-auth
In den letzten 30 Tagen veröffentlichte Sicherheitslücken für @perfood/couch-auth: 0. Davon im KEV-Katalog: 0.
Sicherheitslücken: 5
CVE-2025-70948
A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header.
Veröffentlicht AktualisiertCVE-2025-60794
Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.
Veröffentlicht AktualisiertCVE-2024-57177
A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information
Veröffentlicht AktualisiertCVE-2023-39655
A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords and take over their accounts.
Veröffentlicht Aktualisiert
Prüfen Sie Ihren Server
Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.