CVE-2024-57177: CouchAuth has a Server-Side Template Injection vulnerability in its email functionality

February 10, 2025 (updated December 18, 2025)

A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information.

References

github.com/advisories/GHSA-r385-c5fc-x56c
github.com/perfood/couch-auth
github.com/waristea/cve-research/tree/main/CVE-2024-57177
nvd.nist.gov/vuln/detail/CVE-2024-57177

Code Behaviors & Features

Detect and mitigate CVE-2024-57177 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →