GHSA-44jh-23m7-hpcf: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

October 27, 2026

Database-backed rate limiting on PostgreSQL can let a burst of concurrent requests go over the configured maximum. When many requests arrive at the same time, several of them can pass the limit check together. This weakens the rate limit on password sign-in, two-factor verification, one-time codes, password resets, and other rate-limited endpoints.

References

github.com/advisories/GHSA-44jh-23m7-hpcf
github.com/better-auth/better-auth/commit/35d7cd389220f99cfc98ac699e6a42b48313a740
github.com/better-auth/better-auth/pull/11331
github.com/better-auth/better-auth/releases/tag/v1.7.7
github.com/better-auth/better-auth/security/advisories/GHSA-44jh-23m7-hpcf

Code Behaviors & Features

Detect and mitigate GHSA-44jh-23m7-hpcf with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →