GHSA-62vx-hpcr-m9ch
@perfood/couch-auth may expose session tokens, passwords
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @perfood/couch-auth | <= 0.21.2 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.
References
External links from the advisory. They lead to third-party sites.