{"action":"Upgrade better-auth to 1.4.5 or later.","affected":[{"fixed":"1.4.5","introduced":"0"}],"component":"better-auth","cve_ids":["CVE-2025-71399"],"ecosystem":"npm","epss":0.0052,"exploited":false,"fixed_versions":["1.4.5"],"ghsa_id":"GHSA-x732-6j76-qmhm","id":"tcs_01M5KGH90RSNNZM1R7ECKK790A","modified_at":"2026-08-03T03:41:44.584235266Z","published_at":"2025-12-16T21:22:45Z","references":["https://osv.dev/vulnerability/GHSA-x732-6j76-qmhm","https://github.com/better-auth/better-auth/security/advisories/GHSA-x732-6j76-qmhm","https://github.com/better-auth/better-auth"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-x732-6j76-qmhm","url":"https://osv.dev/vulnerability/GHSA-x732-6j76-qmhm"}],"summary":"Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits"}