CVE-2025-60794: 
JavaScript vulnerability analysis and mitigation

CVE-2025-60794 is a sensitive data exposure vulnerability in the @perfood/couch-auth npm package (versions ≤ 0.21.2) where session tokens and passwords are stored in JavaScript objects and remain in memory without explicit clearing. The flaw exists specifically in src/user.ts at lines 700–707, creating an opportunity for sensitive data extraction via memory dumps, debugging tools, or other memory access techniques, potentially enabling session hijacking. The vulnerability was discovered in October 2025, reported privately to the vendor in November 2025, and published on November 20, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) as assessed by CISA-ADP, and a CVSS v4.0 score of 6.6 (Moderate) per GitHub Advisory (Github Advisory, Security Advisory).

The root cause is classified as CWE-316 (Cleartext Storage of Sensitive Information in Memory): the library stores authentication credentials — including session tokens and plaintext passwords — in JavaScript objects within the Node.js process heap without zeroing or explicitly clearing them after use (Github Advisory). Because JavaScript does not provide deterministic memory management, these sensitive values can persist in the process's memory space long after they are no longer needed. An attacker with the ability to access the process memory — through a memory dump, a Node.js debugging interface (e.g., --inspect), a core dump, or a co-located process with sufficient OS-level privileges — could extract these credentials. The specific vulnerable code is located in src/user.ts, lines 700–707 of version 0.21.2 (Security Advisory).

Successful exploitation allows an attacker to extract session tokens and/or user passwords from the memory of the Node.js process running couch-auth, leading to unauthorized account access and session hijacking. Compromised session tokens could be used to authenticate against both the application API and any associated CouchDB or Cloudant databases the user is authorized to access, potentially exposing all user-specific data stored therein. The confidentiality impact is rated High under CVSS v4.0, with no direct integrity or availability impact from the vulnerability itself (Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of publication. The EPSS score is approximately 0.02% (6th percentile), indicating a low near-term probability of exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local or privileged access to the server process memory, which significantly limits the attacker pool compared to purely remote vulnerabilities. No threat actor attribution has been reported.

1. Identify target: Locate a server running a Node.js application that uses @perfood/couch-auth version ≤ 0.21.2, accessible via npm package inspection or application fingerprinting.
2. Gain process-level access: Obtain the ability to read the Node.js process memory. This could be achieved via: a compromised co-located container/VM, access to a Node.js debug port (--inspect or --inspect-brk) left exposed, OS-level privileges (e.g., root or the same user account as the Node process), or triggering a core dump.
3. Extract process memory: Use tools such as gcore (Linux), /proc/<pid>/mem, or a Node.js REPL/debugger session to dump the heap of the target process.
4. Search for credentials: Parse the memory dump for patterns matching session tokens (random alphanumeric strings) or password strings associated with couch-auth data structures originating from src/user.ts lines 700–707.
5. Replay credentials: Use extracted session tokens in an Authorization: Bearer {token}:{password} header to authenticate against the application's protected API endpoints or directly against the CouchDB/Cloudant instance (Security Advisory, Github Advisory).

• Process: Unexpected attachment of a debugger to the Node.js process (e.g., node --inspect connections from unauthorized IPs); unusual child processes such as gcore, dd, or memory forensics tools spawned by or alongside the Node.js process.
• File System: Unexpected core dump files (e.g., core.<pid>) or heap snapshot files (.heapsnapshot) in the application directory or /tmp; unauthorized access to /proc/<pid>/mem on Linux systems.
• Logs: Authentication events using valid session tokens from unexpected IP addresses or geographic locations; multiple rapid API requests using the same session token from different source IPs (token replay).
• Network: Outbound connections from the server to unknown external IPs shortly after a memory access event, potentially indicating exfiltration of extracted credentials.

As of the advisory publication date (November 20, 2025), the GitHub Advisory Database lists no patched version available for @perfood/couch-auth, and the vendor had not responded to the private disclosure (Github Advisory, Security Advisory). Recommended mitigations include: (1) restricting access to the Node.js process and its debug interfaces (disable --inspect in production, block port 9229); (2) ensuring the server runs with least-privilege OS accounts to limit memory access by other processes; (3) deploying the application in isolated containers with restricted inter-process access; (4) monitoring for unauthorized access to process memory or unexpected core dumps; and (5) rotating session tokens and credentials regularly. Monitor the couch-auth repository and npm package for a patched release.

The vulnerability was discovered and reported by the researcher behind the pr0wl1ng/security-advisories GitHub repository, who noted that as of November 17, 2025, no response had been received from the vendor after private disclosure via GitHub Security Advisory (Security Advisory). No significant broader industry commentary, vendor statements, or notable social media discussion has been identified for this vulnerability.