Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 2 August 2026.

Which products and versions are affected?

better-auth (npm) SEMVER:introduced=0,fixed=1.4.2.

Is there a fix for This vulnerability?

Yes. better-auth (npm): upgrade to 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

better-auth external request basePath modification DoS

Severity: low · CVSS 3.1 · Published 2026-08-02

better-auth is an authentication library for web applications. When the base URL is not explicitly configured, an attacker can make the initial request to a newly started server to set a malicious base path, causing the application to return 404 errors for all subsequent requests and denying service to legitimate users. This vulnerability only affects self-hosted deployments without proper baseURL configuration.

Technologies: better-auth (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 2 August 2026.
Which products and versions are affected?: better-auth (npm) SEMVER:introduced=0,fixed=1.4.2.
Is there a fix for This vulnerability?: Yes. better-auth (npm): upgrade to 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

better-auth (npm): upgrade to 1.4.2 or later
```
npm install better-auth@1.4.2
```

Technical details

The vulnerability is a resource allocation issue (CWE-770) where better-auth allows external requests to configure the baseURL when it is not otherwise defined. The attack requires two preconditions: (1) baseURL is not explicitly configured via environment variables (e.g., BETTER_AUTH_URL is unset), and (2) the attacker can make the very first HTTP request to the server immediately after startup. When these conditions are met, the attacker's request can poison the router's base path configuration, causing all routes to return 404 errors and creating a denial of service. The vulnerability is not reachable when baseURL is explicitly configured through environment variables or on managed hosting platforms that provide base URL configuration. The fix is to upgrade to better-auth version 1.4.2 or later.

Affected products

better-auth better-auth < 1.4.2

Timeline

2025-11-27: disclosed: GHSA-569q-mpph-wgww published
2025-11: patched: Version 1.4.2 released with fix
2026-08-02: other: Duplicate advisory GHSA-3q45-2fh7-66cj published
2026-09-01: other: Duplicate advisory withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.