CVE-2023-39655 is a Critical severity (CVSS 9.6) host header injection in the npm package @perfood/couch-auth, versions up to and including 0.20.0. A crafted Host header on a forgot password request can leak reset tokens. No fixed version is confirmed, so check the package page.
What's affected
Affected: the npm package @perfood/couch-auth, versions up to and including 0.20.0. The record does not name a fixed release, and the research write-up I fetched also does not state one. Check the npm package page and the project's repository for a newer release before relying on it.
How to check if you're exposed
In a Node.js project, list where the package appears, including as a transitive dependency:
npm ls @perfood/couch-auth
For other package managers, use the equivalent such as yarn why @perfood/couch-auth or pnpm why @perfood/couch-auth. Any version at or below 0.20.0 is in range. Also check lockfiles in every service repository and any container images that bundle the package.
What to do now
- Run the dependency listing above across all repositories and deployed images.
- Check the package page on npm and the maintainers' repository for a release newer than 0.20.0, and upgrade if one exists.
- Until you have a fix, build reset links from a server configured base URL and not from the incoming Host header, and have your proxy reject unexpected Host values.
- Review recent password reset requests for odd hosts, and invalidate outstanding reset tokens if you see any.
- Consider moving to an actively maintained authentication library if no fix appears.
Why it matters
The weakness class is CWE-74 (injection), specifically host header injection. The application builds the link in a password reset email from the Host header of the incoming request. If an attacker can send a forgot password request with a crafted Host value, the emailed link points to a server they control. When the user clicks it, the reset token goes to the attacker, who can then reset the password and take over the account.
The CVSS vector in the record is network, low complexity, no privileges, user interaction required, with changed scope, giving 9.6. The user interaction is a click on an email link, which is a realistic step. NVD published the record on 2024-01-03. The KEV flag is false.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull in packages, and the Gold directory lists this CVE alongside its CWE and related records. Reachability analysis helps you rank findings by whether the vulnerable code is actually used, which matters when a long list of advisories lands at once.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed version?
Not one I could confirm. The record covers versions up to 0.20.0 and the write-up does not name a fix, so check npm and the repository.
Does a reverse proxy help?
It can. Rejecting requests whose Host header is not on an allow list removes the attacker's lever, but the cleaner fix is to stop trusting that header when building links.
Sources
Last reviewed: 19 October 2026.
