CVE-2025-71399

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 which bundles the fixed rou3, this can allow...

CVE-2025-71399

CVE-2025-71399 affects Better Auth prior to version 1.4.5, which ships a vulnerable rou3 router. In rou3, path normalization removes empty segments, causing /path, //path, and ///path to resolve to the same route. This enables an attacker to bypass disabledPaths configuration and path-based rate ...

EUVD-2025-210590

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 which bundles the fixed rou3, this can allow...

EUVD-2025-203845

Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits...

Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits

Summary An issue in the underlying router library rou3 can cause /path and //path to be treated as identical routes. If your environment does not normalize incoming URLs e.g., by collapsing multiple slashes, this can allow bypasses of disabledPaths and path-based rate limits. Details Better Auth...

@alstar/studio (=0.0.0-beta.20), @andersondacampo/volt-core (=0.3.0) +165 more potentially affected by unknown CVE via rou3 (>=0.1.0 <=0.6.3)

rou3 NPM version =0.1.0, =1.2.6-beta.6, =1.0.24, =0.0.1, =1.3.24, =0.8.2, =1.4.0, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.27, =1.3.37 and more Source cves: unknown CVE Source advisory: SNYK:JS-ROU3-14459107...

GHSA-X732-6J76-QMHM Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits

Summary An issue in the underlying router library rou3 can cause /path and //path to be treated as identical routes. If your environment does not normalize incoming URLs e.g., by collapsing multiple slashes, this can allow bypasses of disabledPaths and path-based rate limits. Details Better Auth...

Path Equivalence

Overview rou3 is a Lightweight and fast router for JavaScript. Affected versions of this package are vulnerable to Path Equivalence due to insufficient preservation of empty segments. An attacker can bypass access restrictions and rate limits by sending requests with multiple slashes in the URL...