Vulnerabilities in pkg:npm/@supabase/auth-js
PACKAGECVE-2025-48370 is a LOW auth-js vulnerable to insecure path vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting @supabase/auth js libraries in the npm ecosystem. The issue involves auth-js vulnerable to insecure path routing from malformed user input. Remediation is available by upgrading affected packages to version 2.70.0.
pkg:npm/@supabase/auth-js
Vulnerability advisories affecting package pkg:npm/@supabase/auth-js. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-8r88-6cj9-9fh5 | CVE-2025-48370 | LOW | auth-js Vulnerable to Insecure Path Routing from Malformed User Input |
CVE-2025-48370 at a Glance
How to Fix CVE-2025-48370
To remediate this vulnerability, upgrade all affected @supabase/auth js dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @supabase/auth-js@2.70.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @supabase/auth-jsHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2025-48370, inspect your project dependencies using npm:
npm ls @supabase/auth-jsAnalyze the terminal output to locate any version of @supabase/auth js in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.70.0), your application is affected.
Note: The npm ls @supabase/auth-js command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In @supabase/auth js, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-48370 Affected @supabase/auth js Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@supabase/auth-js
|
npm |
< 2.70.0
|
2.70.0
|
References
Frequently Asked Questions
What is CVE-2025-48370?
Which @supabase/auth js versions are affected?
What version fixes CVE-2025-48370?
Is @supabase/auth-js affected?
What CWE is associated with CVE-2025-48370?
How can I check npm dependencies for CVE-2025-48370?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-8r88-6cj9-9fh5",
"modified" : "2026-05-05T17:59:54Z",
"published" : "2025-05-27T18:00:17Z",
"aliases" : [ "CVE-2025-48370" ],
"summary" : "auth-js Vulnerable to Insecure Path Routing from Malformed User Input",
"details" : "### Impact\nThe library functions `getUserById`, `deleteUser`, `updateUserById`, `listFactors` and `deleteFactor` did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called.\n\nImplementations that follow security best practice and validate user controlled inputs, such as the `userId` are not affected by this.\n\n### Patches\nStrict value checks have been added to all affected functions. These functions now require that the `userId` and `factorId` parameters MUST be valid UUID (v4).\n\n**Patched version:** >= 2.69.1\n\n### Workarounds\nImplementations that follow security best practice and validate user controlled inputs, such as the `userId` are not affected by this. It is recommended that users of the auth-js library always follow security best practice and validate all inputs, before passing these to other functions or libraries.\n\n### References\nhttps://github.com/supabase/auth-js/pull/1063",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@supabase/auth-js"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.70.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 2.69.1"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/supabase/auth-js/security/advisories/GHSA-8r88-6cj9-9fh5"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-48370"
}, {
"type" : "WEB",
"url" : "https://github.com/supabase/auth-js/pull/1063"
}, {
"type" : "WEB",
"url" : "https://github.com/supabase/auth-js/commit/1bcb76e479e51cd9bca2d7732d0bf3199e07a693"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/supabase/auth-js"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2025-05-27T18:00:17Z",
"nvd_published_at" : "2025-05-27T16:15:32Z"
}
}