npm Package Vulnerabilities
Vulnerabilities associated with @perfood/couch-auth.
Packages
Clear package- openclaw588 vulnerabilities
- n8n139 vulnerabilities
- parse-server116 vulnerabilities
- flowise112 vulnerabilities
- electron65 vulnerabilities
- next64 vulnerabilities
- directus58 vulnerabilities
- nocodb54 vulnerabilities
- hono47 vulnerabilities
- axios43 vulnerabilities
- vm243 vulnerabilities
- ghost41 vulnerabilities
- @budibase/server40 vulnerabilities
- undici35 vulnerabilities
- flowise-components29 vulnerabilities
- @anthropic-ai/claude-code28 vulnerabilities
- dompurify28 vulnerabilities
- pnpm28 vulnerabilities
- astro25 vulnerabilities
- @openzeppelin/contracts-upgradeable22 vulnerabilities
- better-auth22 vulnerabilities
- vite22 vulnerabilities
- @openzeppelin/contracts21 vulnerabilities
- fuxa-server21 vulnerabilities
- nuxt21 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
@perfood/couch-auth has a host header injection vulnerabilityA host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header. | CVSS-v4.0 | EPSS0.352% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2025-70949HIGH | @perfood/couch-auth has an Observable Timing DiscrepancyAn observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel. CWE-208Mar 5, 2026 | CVSS7.5v3.1 | EPSS0.379% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
@perfood/couch-auth may expose session tokens, passwordsSession tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking. CWE-316Nov 20, 2025 | CVSS-v4.0 | EPSS0.203% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-57177HIGH | CouchAuth has a Server-Side Template Injection vulnerability in its email functionalityA host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information | CVSS7.3v3.1 | EPSS0.311% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-39655CRITICAL | CouchAuth host header injection vulnerability leaks the password reset tokenA host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords and take over their accounts. CWE-74Jan 3, 2024 | CVSS9.6v3.1 | EPSS0.521% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |