CVE-2025-71399 Better Auth before 1.4.5 Path Normalization Bypass via rou3
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2025-71399?
CVE-2025-71399 is a high-severity vulnerability in better-auth, published on 2 Aug 2026.
Official description
Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply in deployments where the proxy or platform normalizes URLs by collapsing multiple slashes.
Weakness: CWE-20
Which versions are affected by CVE-2025-71399?
2 open source packages ship an affected version, including better-auth.
| Package | Affected | Fixed in |
|---|---|---|
better-auth npm | All versions | 1.4.5 |
better-auth npm | All versions | 1.4.5 |
How do I fix CVE-2025-71399?
Upgrade better-auth to 1.4.5 or later.
Is CVE-2025-71399 being exploited?
There is no known exploitation of CVE-2025-71399 in the wild and no public exploit code.
Sources
Also known as GHSA-9fq7-6g6p-g9rm, GHSA-x732-6j76-qmhm.