Which versions of Better Auth are affected by CVE-2025-71401?

Better Auth (npm package) before version 1.4.2 is vulnerable to a complete authentication outage that can be triggered by publicly available exploit code.. A patch is available.

How to fix or mitigate CVE-2025-71401?

Immediately upgrade Better Auth to version 1.4.2 in all environments within 24 hours, and verify that baseURL is explicitly configured to prevent initialization from untrusted headers. Complete regression testing of all authentication flows in a production-equivalent staging environment within 7 days, then deploy the patched version to production and monitor logs for any 404 errors on authentication routes. Within 30 days, conduct a security review of your HTTP header handling practices, implement input validation rules to prevent X-Forwarded-* header injection attacks, and update your deployment procedures to mandate explicit baseURL configuration.

Better Auth CVE-2025-71401

Q: What is the CVSS score of CVE-2025-71401?

CVE-2025-71401 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210592 CRITICAL

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-02 VulnCheck

GHSA-3q45-2fh7-66cj

GHSA-569q-mpph-wgww

Denial Of Service Node.js Better Auth

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network unauthenticated (AV:N/PR:N/UI:N) but AC:H for the first-request race plus required unconfigured baseURL; impact is availability-only (A:H, C:N, I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 02, 2026 - 13:01 vuln.today

Analysis Generated

Aug 02, 2026 - 13:01 vuln.today

Patch available

Aug 02, 2026 - 13:01 EUVD

CVE Published

Aug 02, 2026 - 12:15 cve.org

CRITICAL 9.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 npm packages depend on better-auth (3 direct, 1 indirect)

Ecosystem-wide dependent count for version 1.4.2.

DescriptionCVE.org

better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.

Articles & Coverage 1

News Critical DoS via Header Injection in Better Auth (Node.js) - CVE-2025-71401 Aug 02, 2026

AnalysisAI

Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base path when baseURL is not explicitly configured. By sending the very first request after server startup with crafted X-Forwarded-Host and X-Forwarded-Proto headers, the attacker forces every subsequent auth route to return 404 for all users until restart. A working reproduction (curl commands) is published in the GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing and no public exploit identified as being used in active attacks.

Technical ContextAI

Better Auth is a framework-agnostic authentication library for Node.js/TypeScript applications, exposing its endpoints under a base path (typically /api/auth) derived from the configured baseURL. When baseURL is not set through configuration or the BETTER_AUTH_URL environment variable, the library falls back to reconstructing it from inbound request headers, implicitly trusting the X-Forwarded-Host and X-Forwarded-Proto values. getBaseURL() parses these into a URL object whose pathname then determines the router's basePath. Because the fallback caches the value derived from the first request, an attacker-controlled forwarded header set (e.g. Proto 'some:' and Host 'junk') corrupts the parsed pathname and the resulting basePath, after which the router can no longer match legitimate requests. The CWE-770 mapping (handling of a resource without proper limits or validation) captures the root cause loosely, though the more precise class is improper trust of client-supplied forwarded headers used to derive server routing state.

RemediationAI

Vendor-released patch: 1.4.2 - upgrade the better-auth npm dependency to 1.4.2 or later, which is the primary and complete fix (see GHSA-569q-mpph-wgww). If immediate upgrade is not possible, explicitly set baseURL in the Better Auth configuration or define the BETTER_AUTH_URL environment variable; doing so disables the vulnerable header-derived fallback entirely and is the most effective compensating control with essentially no downside for a correctly deployed service. Additionally, terminate the application behind a reverse proxy or load balancer that strips or overwrites client-supplied X-Forwarded-Host and X-Forwarded-Proto headers before they reach the app, so only trusted forwarded values are honored - note this must be enforced at the trusted proxy layer, since app-level trust of these headers is exactly what is abused. Managed hosting platforms that already fix the base URL are not affected.