CVE-2025-71401 better-auth CVE debrief

Who should care

Defenders responsible for better-auth (npm) deployments should assess exposure and prioritize verification and remediation. This includes reviewing better-auth versions, assessing environment exposure, and monitoring for potential attacks. Security teams and vulnerability management teams should also be aware of this critical vulnerability and its potential impact on their environments.

Why it matters

CVE-2025-71401 is a critical vulnerability in better-auth (npm) before version 1.4.2, allowing an external request to configure baseURL and potentially causing a denial of service. Defenders should prioritize verification and remediation.

• Potential denial of service due to router base path poisoning
• Verification of better-auth version and exposure in environments
• Monitoring for potential attacks

Technical summary

The better-auth (npm) package before version 1.4.2 allows an external request to configure baseURL when it is not otherwise defined. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). This vulnerability is critical as it can be exploited by an external attacker, emphasizing the need for prompt verification and remediation. The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.

Defensive priority

Defenders should prioritize verifying and upgrading to better-auth version 1.4.2 or later, and assess exposure in their environments.

Recommended defensive actions

• Verify better-auth version and upgrade to 1.4.2 or later if necessary
• Assess exposure in environments using better-auth
• Monitor for potential denial of service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in better-auth (npm) before version 1.4.2. The issue allows an external request to configure baseURL, potentially causing a denial of service. Evidence is based on official CVE and NVD sources, with limitations on affected scope and vendor guidance. Defenders should verify better-auth versions and assess exposure in their environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.