CVE-2025-71404
1 advisory.
npm/better-auth CVE-2025-71404: medium
Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)
Action: Upgrade better-auth to 1.1.16 or later.
npm i better-auth@1.1.16Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.0.2 | 1.1.16 | - |
Fixed versions
| 1.1.16 |
Sources
- osv: GHSA-9x4v-xfq5-m8x5
- https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5
- https://github.com/better-auth/better-auth/commit/7ae340e2eddad641b7e43d24d37c58a66ce9ddcf
- https://github.com/better-auth/better-auth
- https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81
CVE-2025-71404 · published · modified · JSON