Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@perfood/couch-auth

5 known vulnerabilities (2 critical, 2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
0.28.0 (Jun 1, 2026): no advisory affects it
Newest unaffected release
0.28.0 (Jun 1, 2026), the latest release
Advisories
5 · 2 critical, 2 high, 1 medium
Weekly downloads
553
Dependents
0
Releases
34 since 0.16.2 (Jan 24, 2022)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.

    Affected: through 0.26.0.

    Fixed in 0.27.0 (released Apr 14, 2026, 40 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.28.0, is not affected.

    70% of @perfood/couch-auth downloads last week were affected versions (507).

  • CVE-2025-70948Critical 9.3

    A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and…

    Affected: through 0.26.0.

    Fixed in 0.27.0 (released Apr 14, 2026, 40 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.28.0, is not affected.

    70% of @perfood/couch-auth downloads last week were affected versions (507).

  • CVE-2025-60794Medium 6.5

    Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in…

    Affected: through 0.21.2.

    Fixed in 0.22.0 (released Oct 30, 2025, 21 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.28.0, is not affected.

    34% of @perfood/couch-auth downloads last week were affected versions (247).

  • A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2.

    Affected: through 0.21.2.

    Fixed in 0.22.0 (released Oct 30, 2025, 262 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.28.0, is not affected.

    34% of @perfood/couch-auth downloads last week were affected versions (247).

  • CVE-2023-39655Critical 9.6

    A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0.

    Affected: through 0.20.0.

    Fixed in 0.20.1 (released Nov 21, 2023, 43 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.28.0, is not affected.

    15% of @perfood/couch-auth downloads last week were affected versions (108).