CVE-2025-70948: Host Header Injection Vulnerability in @perfood/couch-auth
Summary
CVE-2025-70948: @perfood/couch-auth has a host header injection vulnerability. Affects @perfood/couch-auth versions < 0.26.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @perfood/couch-auth package is an authentication library designed for use with CouchDB, providing functionalities such as user management and token-based authentication. It is widely used in applications that require secure access control. However, version 0.26.0 of this package is vulnerable to a host header injection issue, which can lead to severe security risks.
Vulnerability Detail
A host header injection vulnerability exists in the mailer component of @perfood/couch-auth v0.26.0. This vulnerability allows attackers to spoof the HTTP Host header, potentially enabling them to obtain reset tokens and execute account takeover attacks. The issue arises from improper validation of the Host header, which can be exploited to manipulate the behavior of the application, leading to unauthorized access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement strict validation of the Host header in your application code to mitigate the risk of exploitation. For example, you can check the Host header against a whitelist of allowed hosts before processing requests.
Conclusion
The host header injection vulnerability in @perfood/couch-auth v0.26.0 poses a significant security risk, allowing for potential account takeover. It is crucial to update to the latest version of the package or implement workarounds to mitigate the risk. Regular monitoring with tools like Vulert can help keep your applications secure.
See every vulnerability recorded for @perfood/couch-auth →
FAQ
A host header injection vulnerability occurs when an application does not properly validate the Host header in HTTP requests, allowing attackers to manipulate the header and potentially gain unauthorized access.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your package-lock.json without needing to sign up.
If exploited, this vulnerability can lead to account takeover, where an attacker can reset user passwords and gain unauthorized access to user accounts.
Yes, updating to the latest version of @perfood/couch-auth will resolve the vulnerability. Use npm install @perfood/couch-auth@latest to update.
If an immediate update is not possible, implement strict validation of the Host header in your application to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for @perfood/couch-auth.
