CouchAuth host header injection vulnerability leaks the password reset token

Description

A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.20.0

References

• GHSA-fqh6-6h6c-366m
• www.npmjs.com
• CVE-2023-39655
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - CVE-2025-65944
• validator.js has a URL validation bypass vulnerability in its isURL function - CVE-2025-56200
• Regular Expression Denial of Service (ReDoS) in lodash (GHSA-29mw-wpgm-hmr9) - CVE-2020-28500
• Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter - CVE-2025-58179

Tags:

npm

@perfood/couch-auth