Skip to main content
protocols.pageprotocols.page
5984

Port 5984 – CouchDB

TCP

Port 5984 is the CouchDB HTTP API port. CouchDB exposes its entire database interface as a REST API on port 5984 – creating databases, inserting documents, and running queries all happen over HTTP. Default installations bind to all interfaces with admin party mode (no authentication). Lock down immediately after install.

Port Number

5984

Protocol

TCP

Service

Apache CouchDB HTTP API

Range

IANA Registered (1024–49151)

Description

Apache CouchDB on port 5984 serves its complete database API over HTTP. Every operation – creating databases, CRUD on documents, MapReduce views, replication, and admin functions – uses standard HTTP methods on port 5984. The Fauxton web admin interface also runs on this port at /_utils. CouchDB's admin party mode means fresh installations allow unrestricted access to all data without authentication. Thousands of exposed CouchDB instances have been found with ransomware replacing databases. After installation: create an admin user immediately (PUT /_node/_local/_config/admins/username), bind to 127.0.0.1 in local.ini, and proxy through Nginx with TLS for remote access.

Security risks

  • 1CVE-2017-12635: CouchDB admin creation bypass – specially crafted JSON with duplicate 'roles' keys bypasses authorization checks, allowing any user to grant themselves admin privileges. Exploited trivially with a single PUT request to /_users. Patch to 2.1.1+ immediately.
  • 2CVE-2022-24706: Apache CouchDB RCE via default Erlang cookie – the default erlang.cookie ("monster") allows unauthenticated remote code execution on the underlying OS. Attackers connect to the Erlang distribution port and spawn arbitrary OS commands. Change the cookie and restrict Erlang ports.
  • 3Admin Party mode (default pre-3.0): fresh CouchDB installs have no admin user – anyone with HTTP access to port 5984 has full admin privileges including creating databases, reading all documents, and configuring replication. Create an admin user via PUT /_node/_local/_config/admins/username immediately after install.
  • 4Futon/Fauxton UI exposure: the web admin interfaces (Futon on CouchDB 1.x at /_utils, Fauxton on 2.x+ at /_utils/) provide full database management. If port 5984 is reachable, these UIs allow browsing, editing, and deleting all documents without additional authentication beyond CouchDB's own.
  • 5Replication credential theft: CouchDB stores replication configurations in the _replicator database, which may contain plaintext credentials for target databases. Unauthenticated access to port 5984 exposes these credentials.

Firewall guidance

Never expose port 5984 to the internet. Bind to 127.0.0.1 in local.ini ([chttpd] bind_address = 127.0.0.1). For application access, use a reverse proxy (Nginx) with TLS termination and IP restriction. Block port 5986 (cluster admin) and 4369 (EPMD) from all external access. If replication is needed across networks, use CouchDB's built-in SSL (port 6984) with client certificate verification.

Diagnosis commands

Check CouchDB version (determines which CVEs apply)

shell
curl -s http://localhost:5984/ | jq .version

List all databases – if this works without auth, you are in Admin Party mode

shell
curl -s http://localhost:5984/_all_dbs | jq .

Check if admin users exist (empty object = Admin Party)

shell
curl -s http://localhost:5984/_node/_local/_config/admins | jq .

CouchDB health check endpoint (2.x+)

shell
curl -s http://localhost:5984/_up | jq .

Usage examples

Port 5984 – CouchDB
shell
curl http://localhost:5984/
curl http://localhost:5984/_all_dbs
curl -X PUT http://admin:pass@localhost:5984/mydb

Common services on this port

Apache CouchDBIBM Cloudant (CouchDB-based)PouchDB (sync target)Couchbase Lite (sync gateway)

Related ports

6984

CouchDB HTTPS (SSL/TLS)

5986

CouchDB cluster admin (Erlang)

4369

EPMD (Erlang node discovery)

History

CouchDB was created by Damien Katz in 2005, became an Apache project in 2008. Port 5984 was chosen arbitrarily. CouchDB pioneered the document-oriented database model with HTTP REST API and master-master replication. Version 2.0 (2016) added clustering. The 'Admin Party' default was changed to require admin setup in CouchDB 3.0 (2020). IBM forked it as Cloudant for their cloud offering.

FAQ

How do I secure a CouchDB installation?

1. Create admin user immediately: curl -X PUT http://localhost:5984/_node/_local/_config/admins/admin -d '"strongpassword"'. 2. Bind to localhost: [chttpd] bind_address = 127.0.0.1. 3. Change Erlang cookie from default 'monster'. 4. Enable require_valid_user = true in [chttpd] section. 5. Use HTTPS (port 6984) with valid certificates for any network-accessible deployment.

Is CouchDB safe to expose with authentication enabled?

With authentication enabled and require_valid_user=true, unauthorized users cannot access data. However, the HTTP API surface is large – prefer a reverse proxy that exposes only specific endpoints your application needs. Never expose /_utils (admin UI) or /_node (cluster config) to untrusted networks even with auth enabled.