CVE-2025-70949

Impact

An Observable Timing Discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.

Affected packages

Weakness classification

References

• NVD record
• CVE.org record
• GitHub advisory
• https://gist.github.com/0xHunterr/38aab644874ca9f4646524c5b01cfe5e
• https://github.com/perfood/couch-auth
• https://www.npmjs.com/package/@perfood/couch-auth
• https://github.com/advisories/GHSA-mjqr-5c55-g77h
• https://nvd.nist.gov/vuln/detail/CVE-2025-70949