@better-auth/core is vulnerable to Server-Side Request Forgery (SSRF)
81
High Risk
This package now publishes a single host and IP classification implementation used to decide whether a hostname is true loopback, a cloud or link-local style address, or a publicly routable host, including IPv4, IPv6, zone IDs, IPv4-mapped forms, and a curated set of cloud metadata style names. Earlier releases did not ship that module, so consumers spread ad hoc string checks and regular expressions that were easier to misclassify around loopback, metadata endpoints, and special ranges. The new API gives one place to enforce those rules for URL validation and outbound fetch gating across the monorepo.
You are affected if you are using a version that falls within the vulnerable range.
@better-auth/core is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.3.18 - 1.6.5.
Upgrade the @better-auth/core library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

SOC 2Compliant
ISO 27001Compliant