CVE-2025-71401: better-auth before 1.4.2 basePath Modification DoS
better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTERAUTHURL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/better-authto a version that resolves this vulnerability.Fixed in 1.4.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71401?
The severity of CVE-2025-71401 is medium with a score of 5.9.
How do I fix CVE-2025-71401?
To fix CVE-2025-71401, upgrade better-auth to version 1.4.2 or later.
What type of vulnerability is CVE-2025-71401?
CVE-2025-71401 is a Denial of Service (DoS) vulnerability affecting better-auth.
What does CVE-2025-71401 affect?
CVE-2025-71401 affects the better-auth package in npm prior to version 1.4.2.
Who is at risk due to CVE-2025-71401?
Any server running a vulnerable version of better-auth may be at risk if an attacker can make early requests after startup.