-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists in a dependency of better-auth, specifically the rou3 routing library. The advisory points to a commit in the h3js/rou3 repository that fixes the issue. Analysis of this commit reveals that the splitPath function in src/operations/_utils.ts was modified. The previous implementation of this function would treat paths with multiple consecutive slashes (e.g., //some/path) as identical to paths with single slashes (e.g., /some/path). This path normalization flaw could be exploited to bypass security controls in better-auth that rely on path matching, such as the disabledPaths configuration and rate limiting. The patch alters the logic of splitPath to correctly handle and preserve empty path segments, thus ensuring that paths with multiple slashes are treated distinctly from their single-slashed counterparts, mitigating the bypass vulnerability.
splitPathsrc/operations/_utils.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| better-auth | npm | < 1.4.5 | 1.4.5 |