CVE-2025-60794: Perfood Couchauth Info Disclosure Flaw

CVE-2025-60794 Overview

CVE-2025-60794 affects @perfood/couch-auth version 0.21.2, a Node.js authentication library for CouchDB. The library stores session tokens and passwords in JavaScript objects without explicit clearing after use. The unsanitized data persists in memory at src/user.ts lines 700-707, exposing credentials to memory dumps, debugging tools, and other memory inspection techniques. This condition maps to [CWE-316] Cleartext Storage of Sensitive Information in Memory. An attacker with sufficient access to process memory can extract session tokens and hijack authenticated sessions.

Critical Impact
Session tokens and cleartext passwords persist in Node.js process memory, enabling session hijacking if an attacker gains memory access through debugging tools, core dumps, or co-tenant process exposure.

Affected Products

@perfood/couch-auth version 0.21.2 (Node.js package)
Applications embedding couch-auth for CouchDB authentication
Deployments exposing Node.js memory through debugging or core dumps

Discovery Timeline

2025-11-20 - CVE-2025-60794 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60794

Vulnerability Analysis

The vulnerability stems from how couch-auth manages sensitive authentication material inside JavaScript objects. Session tokens and password values are assigned to object properties during authentication flows in src/user.ts (lines 700-707). The code does not overwrite or null these properties after use.

JavaScript does not offer deterministic memory zeroing for primitive strings. String values remain in the V8 heap until garbage collection reclaims them. An attacker who acquires a heap snapshot, a core dump, or attaches an inspector can read these values in cleartext.

The exposure widens in shared or containerized environments. Diagnostic tooling, crash reporters, and orchestration platforms often capture process memory. Any of these artifacts becomes a credential store when couch-auth is loaded.

Root Cause

The root cause is missing sanitization of sensitive fields after their operational lifetime. The library treats tokens and passwords as ordinary object properties. It never invokes explicit clearing routines or scopes secrets to short-lived buffers.

Attack Vector

Exploitation requires access to the Node.js process memory. Access paths include Node.js --inspect debugging endpoints, core dumps written after crashes, container introspection APIs, and local privilege escalation on the host. After obtaining a memory image, the attacker searches for token patterns or known session identifiers.

Extracted session tokens allow the attacker to impersonate authenticated users against the CouchDB backend. Extracted passwords enable credential reuse across other services. The security advisory at GitHub Security Advisory CVE-2025-60794 documents the vulnerable code path.

Detection Methods for CVE-2025-60794

Indicators of Compromise

Unexpected core dumps or heapdump files generated by Node.js processes running couch-auth
Node.js processes started with --inspect, --inspect-brk, or exposed debugger ports in production
Access to /proc/<pid>/mem or gcore invocations against Node.js processes by non-root operators
Session activity from IP addresses or user agents not consistent with the legitimate user session baseline

Detection Strategies

Inventory Node.js dependencies and flag any application resolving @perfood/couch-auth@0.21.2 in package-lock.json or yarn.lock
Monitor for process debuggers, memory scrapers, and unauthorized use of node --inspect in production environments
Correlate authentication anomalies in CouchDB access logs with session reuse from unexpected clients

Monitoring Recommendations

Log and alert on creation of .heapsnapshot, core.*, and node.*.dmp files on hosts running couch-auth
Track outbound connections from the Node.js process to unexpected destinations that could indicate memory exfiltration
Baseline session token issuance rates and alert on reuse of a single token from divergent network paths

How to Mitigate CVE-2025-60794

Immediate Actions Required

Audit all Node.js services for the @perfood/couch-auth dependency at version 0.21.2 and upgrade once a fixed release is published upstream
Disable Node.js inspector interfaces (--inspect) and remove debugger ports from production configurations
Restrict who can read process memory by hardening ptrace_scope, container capabilities, and core dump handling
Rotate active session tokens and force password resets for applications running the vulnerable version

Patch Information

As of publication, no fixed release is referenced in the NVD entry. Track the upstream repository at GitHub Repository for Couch Auth and the NPM Package for Couch Auth for a patched version above 0.21.2. Review the GitHub Security Advisory CVE-2025-60794 for maintainer guidance.

Workarounds

Disable core dumps for Node.js processes handling authentication by setting ulimit -c 0 and disabling kernel.core_pattern piping
Isolate couch-auth services in dedicated containers with readOnlyRootFilesystem, no-new-privileges, and dropped SYS_PTRACE capability
Shorten session token lifetimes and enforce token rotation to reduce the value of any memory-extracted credential
Fork couch-auth locally and add explicit sensitive-field clearing after authentication completes if an upstream patch is unavailable

bash

# Configuration example: harden Node.js container against memory extraction
ulimit -c 0
sysctl -w kernel.yama.ptrace_scope=3

# Docker runtime hardening
docker run \
  --cap-drop=SYS_PTRACE \
  --security-opt=no-new-privileges \
  --read-only \
  --tmpfs /tmp \
  couch-auth-service:latest