CouchAuth host header injection vulnerability leaks the password reset token

Description

A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.20.0

References

• GHSA-fqh6-6h6c-366m
• www.npmjs.com
• CVE-2023-39655
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service (ReDoS) in lodash (GHSA-29mw-wpgm-hmr9) - CVE-2020-28500
• CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - CVE-2025-58064
• Payload's SQLite adapter Session Fixation vulnerability (GHSA-26rv-h2hf-3fw4) - CVE-2025-4644
• http-proxy-middleware can call writeBody twice because "else if" is not used - CVE-2025-32996

Tags:

npm

@perfood/couch-auth