@perfood/couch-auth may expose session tokens, passwords

Description

Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.21.2

References

• GHSA-62vx-hpcr-m9ch
• www.npmjs.com
• CVE-2025-60794
• CWE-316
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• node-forge is vulnerable to ASN.1 OID Integer Truncation - CVE-2025-66030
• undici Denial of Service attack via bad certificate data - CVE-2025-47279
• Budibase affected by VM2 Constructor Escape Vulnerability - Vulnerability
• Marvin Attack of RSA and RSAOAEP decryption in jsrsasign - CVE-2024-21484

Tags:

npm

@perfood/couch-auth