Critical severity9.3NVD Advisory· Published Mar 5, 2026· Updated Apr 27, 2026

CVE-2025-70948

Description

A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@perfood/couch-authnpm	<= 0.26.0	—

Affected products

@perfood/@perfood/couch Authreferences
Package: https://npmjs.com/package/@perfood/couch-auth
ghsa-coords
pkg:npm/%40perfood/couch-auth
Range: <= 0.26.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-qw8v-34ww-6q9pghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-70948ghsaADVISORY
gist.github.com/0xHunterr/38aab644874ca9f4646524c5b01cfe5envdWEB
www.npmjs.com/package/@perfood/couch-authnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.605
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000