CVE-2026-110861: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

CVE-2026-110861 · Severity: low · CVSS 3.7 · Published 2026-10-14

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is not atomic with the counter update. Remote attackers can send bursts of concurrent requests that pass the check together, exceeding configured limits on password sign-in, two-factor verification, one-time code, password reset, and other rate-limited endpoints.

Technologies: better-auth (npm). Vendors: npm.

Quick answers

Is CVE-2026-110861 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-110861 being exploited in the wild.
How severe is CVE-2026-110861?
Low severity, with a CVSS score of 3.7, published 14 October 2026.
Which products and versions are affected?
@better-auth/drizzle-adapter (npm) SEMVER:introduced=1.6.17,fixed=1.7.7; @better-auth/kysely-adapter (npm) SEMVER:introduced=1.6.17,fixed=1.7.0; better-auth (npm) SEMVER:introduced=1.6.17,fixed=1.7.7.
Is there a fix for CVE-2026-110861?
Yes. @better-auth/drizzle-adapter (npm): upgrade to 1.7.7 or later; @better-auth/kysely-adapter (npm): upgrade to 1.7.0 or later; better-auth (npm): upgrade to 1.7.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-110861?
Check whether you run @better-auth/drizzle-adapter (npm), @better-auth/kysely-adapter (npm) or better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @better-auth/drizzle-adapter (npm): upgrade to 1.7.7 or later
    npm install @better-auth/drizzle-adapter@1.7.7
  • @better-auth/kysely-adapter (npm): upgrade to 1.7.0 or later
    npm install @better-auth/kysely-adapter@1.7.0
  • better-auth (npm): upgrade to 1.7.7 or later
    npm install better-auth@1.7.7

Affected products

  • @better-auth/drizzle-adapter (npm) SEMVER:introduced=1.6.17,fixed=1.7.7
  • @better-auth/kysely-adapter (npm) SEMVER:introduced=1.6.17,fixed=1.7.0
  • better-auth (npm) SEMVER:introduced=1.6.17,fixed=1.7.7

Identifiers

  • CVE-2026-110861
  • GHSA-44jh-23m7-hpcf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.