Open-source package vulnerability · npm

GHSA-3q45-2fh7-66cj: Duplicate Advisory: better-auth has an external request basePath modification DoS

criticalCVSS 4.0 9.3 · 3.1 5.9

This advisory was withdrawn on Sep 1, 2026. The publisher no longer considers it a valid vulnerability.

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-569q-mpph-wgww. This link is maintained to preserve external references. Original Description better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTERAUTHURL is unset).

Published Aug 2, 2026 · Updated Sep 1, 2026

Affected packages

better-auth

Ecosystem: npm
Affected: < 1.4.2
Fixed in: 1.4.2
Check: npm ls better-auth

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-569q-mpph-wgww. This link is maintained to preserve external references.

Original Description

better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.

Credited to antonisloukis.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More npm vulnerabilities

All npm entries