Threat database

3 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.5	EPSS 0.4%	CVE-2025-70949couch-auth · Timing Side Channel High7.5EPSS 0.4%2026-03-05CVE Database V5CVE-2025-70949 An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel. EPSS 0.4%Vulnerability CWE-208	CVE Database V5	2026-03-05
Critical	9.3	EPSS 0.4%	CVE-2025-70948couch-auth · A Host Header Injection Critical9.3EPSS 0.4%2026-03-05CVE Database V5CVE-2025-70948 A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header. EPSS 0.4%Vulnerability CWE-644	CVE Database V5	2026-03-05
High	7.3	EPSS 0.3%	CVE-2024-57177couch-auth · Template Injection High7.3EPSS 0.3%2025-02-10CVE Database V5CVE-2024-57177 A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information EPSS 0.3%Vulnerability CWE-1336	CVE Database V5	2025-02-10

Page 1 of 1