npmPackage

@auth/core

3 known vulnerabilities (1 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-73420Critical 9.1
NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
Affected: from 0.1.0, fixed in 0.41.3.
Fixed in 0.41.3 (released Jul 20, 2026, 24 days before disclosure).
The latest release, 0.41.3, is not affected.
33% of @auth/core downloads last week were affected versions (2.5M).
CVE-2026-73419Medium 6.8
NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Affected: fixed in 0.41.3.
Fixed in 0.41.3 (released Jul 20, 2026, 23 days before disclosure).
The latest release, 0.41.3, is not affected.
33% of @auth/core downloads last week were affected versions (2.5M).
CVE-2026-73418High 7.5
NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
Affected: from 0.1.0, fixed in 0.41.3.
Fixed in 0.41.3 (released Jul 20, 2026, 23 days before disclosure).
The latest release, 0.41.3, is not affected.
33% of @auth/core downloads last week were affected versions (2.5M).