CVE-2025-71401
Received Received - Intake

better-auth npm BaseURL Poisoning DoS

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: VulnCheck

Description
better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2025-71401
EUVD
EUVD-2025-210592

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
better_auth better_auth to 1.4.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in better-auth (npm) before version 1.4.2 allows an attacker to set the baseURL via an external request if it is not explicitly configured. This can poison the router's base path, causing all routes to return 404 errors for all users, resulting in a denial of service.

Detection Guidance

This vulnerability is specific to better-auth (npm) before version 1.4.2 and involves router base path poisoning. Detection requires checking the installed version of better-auth in your project dependencies. Use commands like 'npm list better-auth' or 'npm ls better-auth' to verify the version. If the version is below 1.4.2, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability can disrupt service availability by causing all user requests to fail with 404 errors. This impacts users relying on the application and may lead to downtime or loss of functionality.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions, potentially violating availability requirements in GDPR and HIPAA. Downtime may lead to unauthorized access risks or failure to meet service level agreements.

Mitigation Strategies

Immediately update better-auth to version 1.4.2 or later using 'npm update better-auth' or by specifying the version in your package.json. Ensure baseURL is explicitly configured in your application to prevent the attack vector. Monitor for 404 errors on all routes as a potential sign of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71401. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart