Executive brief
@perfood/couch-auth is a Node.js authentication library for CouchDB-based applications. The library stores session tokens and passwords in memory without clearing them, creating a risk that sensitive data could be extracted via memory dumps or debugging tools, potentially allowing attackers to hijack user sessions or gain account access.
Technical details
The vulnerability exists in src/user.ts (lines 700-707) where session tokens and passwords are stored in JavaScript objects and not explicitly cleared from memory. The root cause is improper handling of sensitive data lifecycle—objects remain in memory after use without being overwritten or deleted. Attack vector is local (requires memory access through debugging tools or memory dumps), with no network access or authentication required. An attacker with local access to the system or a compromised debugging session could extract these values, leading to session hijacking or account takeover. The issue affects couch-auth version 0.21.2 and potentially all earlier versions; patch availability is not specified in the advisory.
Affected products
- perfood couch-auth 0.21.2 and all earlier versions
Timeline
- 2025-11-20: disclosed