Base path poisoning denial of service in better-auth (npm) (CVE-2025-71401)

better-auth allows an external request to configure the server's baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users. The vulnerability is only reachable when baseURL is not explicitly configured; properly configured environments and typical managed hosting platforms are not affected. Affected versions: - < 1.4.1 We recommend updating to: 1.4.2. CVSS 9.3 · our assessment: act_now Reference: https://github.com/better-auth/better-auth/security/advisories/GHSA-569q-mpph-wgww Details: https://vuln.today/cve/CVE-2025-71401