Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@auth0/nextjs-auth0

7 known vulnerabilities (2 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 2 high, 5 medium
Registry
npm

Advisories 7

  • CVE-2026-40155Medium 5.4

    Auth0 Next.js SDK has Improper Proxy Cache Lookup

    Affected: from 4.12.0, fixed in 4.18.0.

  • CVE-2025-67716Medium 5.7

    Auth0 Next.js SDK has Improper Validation of Query Parameters

    Affected: from 4.9.0, fixed in 4.13.0.

  • CVE-2025-67490Medium 5.4

    Auth0 Next.js SDK has Improper Request Caching Lookup

    Affected: from 4.11.0, fixed in 4.11.2; from 4.12.0, fixed in 4.12.1.

  • NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

    Affected: from 4.0.1, fixed in 4.6.1.

  • CVE-2025-46344Medium 4.9

    Auth0 NextJS SDK v4 Missing Session Invalidation

    Affected: from 4.0.1, fixed in 4.5.1.

  • CVE-2021-43812Medium 6.4

    Open redirect in nextjs-auth0

    Affected: fixed in 1.6.2.

  • Reflected XSS from the callback handler's error query parameter

    Affected: fixed in 1.4.2.