CVE-2025-71401: better-auth npm Package DoS Vulnerability

CVE-2025-71401 Overview

CVE-2025-71401 affects the better-auth npm package before version 1.4.2. The library derives its baseURL from the first inbound request when BETTER_AUTH_URL is unset and no explicit baseURL is configured. An unauthenticated attacker who reaches the server before any legitimate client can poison the router's base path. Once poisoned, every authentication route returns HTTP 404 for all subsequent users, producing a denial-of-service condition across the application. The flaw is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling) and is not exploitable when baseURL is explicitly set or when the service runs on managed hosting platforms that supply the host header canonically.

Critical Impact
A single unauthenticated network request sent immediately after server startup can disable all authentication endpoints for every user of the application.

Affected Products

better-auth npm package, all versions prior to 1.4.2
Node.js applications importing better-auth without an explicit baseURL
Deployments where the BETTER_AUTH_URL environment variable is not defined

Discovery Timeline

2026-08-02 - CVE-2025-71401 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2025-71401

Vulnerability Analysis

The better-auth router lazily computes its base path from HTTP headers on the first request it processes. When neither baseURL nor BETTER_AUTH_URL is set, the library trusts attacker-controlled input, such as the Host or X-Forwarded-Host header, to establish the canonical route prefix. The value is then cached and reused for all future request routing.

An attacker who wins the race to the freshly started server supplies an arbitrary host value. The router persists that value as its base path. Legitimate clients arriving through the correct hostname no longer match the poisoned prefix, so their requests fall through to a 404 handler. Authentication is effectively unavailable until the process is restarted, and the poisoning can be repeated on each restart.

Root Cause

The root cause is the absence of a trusted configuration source for the base path when environment variables are missing. The library treats the first observed request as authoritative, allowing external input to define a security-relevant runtime configuration value without validation, allow-listing, or throttling.

Attack Vector

Exploitation requires only network access to the target service during the window between process start and the first legitimate request. The attacker sends a crafted HTTP request with a manipulated Host header. No authentication, user interaction, or elevated privileges are required. The vulnerability is not reachable on managed hosting platforms that normalize or override the Host header, nor when baseURL is explicitly configured. See the GitHub Security Advisory GHSA-569q-mpph-wgww and the VulnCheck Advisory for further technical detail.

Detection Methods for CVE-2025-71401

Indicators of Compromise

Sudden and sustained HTTP 404 responses on previously working better-auth routes such as /api/auth/* after a process restart.
Access logs showing an early post-startup request with an unexpected Host or X-Forwarded-Host header value from an untrusted source.
Application logs indicating that the derived base path does not match the expected deployment hostname.

Detection Strategies

Compare the router's active base path against the expected canonical URL and alert on drift.
Inspect startup-window request logs for the first inbound HTTP transaction and validate its Host header against an allow-list.
Correlate spikes in authentication endpoint 404 rates with recent deployment or restart events.

Monitoring Recommendations

Emit a structured log event containing the resolved baseURL at application boot for downstream SIEM ingestion.
Track authentication success and failure ratios per host header to detect divergence between advertised and effective hostnames.
Alert when authentication endpoint availability drops below a baseline threshold immediately following a service restart.

How to Mitigate CVE-2025-71401

Immediate Actions Required

Upgrade better-auth to version 1.4.2 or later in all affected Node.js applications.
Explicitly set the baseURL option in the betterAuth() initialization call, or export BETTER_AUTH_URL in the runtime environment.
Audit reverse proxies and load balancers to ensure Host and X-Forwarded-Host headers are set to trusted values before requests reach the application.

Patch Information

The maintainers released better-auth version 1.4.2, which no longer derives the base path from the first inbound request when configuration is absent. Refer to the GitHub Security Advisory GHSA-569q-mpph-wgww for the fix commit and release notes.

Workarounds

Set BETTER_AUTH_URL to the canonical application URL in every deployment environment.
Configure the reverse proxy to strip or override untrusted Host and X-Forwarded-Host headers before forwarding traffic.
Deploy on managed hosting platforms that enforce a canonical host header, which prevents the poisoning condition from being reached.

bash

# Configuration example
export BETTER_AUTH_URL="https://auth.example.com"
npm install better-auth@^1.4.2

# In your application initialization:
# import { betterAuth } from "better-auth";
# export const auth = betterAuth({
#   baseURL: "https://auth.example.com",
#   // ... remaining options
# });