Denial of Service in Better-Auth NPM Package by Better-Auth

CVE-2025-71401

What is CVE-2025-71401?

A vulnerability exists in the Better-Auth NPM package that allows an attacker to configure the baseURL through an unchecked external request. This occurs when the BETTER_AUTH_URL variable is not defined, enabling an attacker who is able to make the first request after server startup to poison the router's base path. As a result, all routes may return 404 errors for every user, resulting in a denial of service. This issue does not manifest when the baseURL is explicitly set or when hosted on standard managed platforms.

References