Skip to main content
cve.nowby Sazabi
← npm
npmPackage

next-auth

13 known vulnerabilities (3 critical, 4 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
4.24.15 (Jul 20, 2026): no advisory affects it
Newest unaffected release
4.24.15 (Jul 20, 2026), the latest release
Advisories
13 · 3 critical, 4 high, 5 medium, 1 low
Weekly downloads
9.2M
Dependents
7,320
Releases
500+ since 3.7.0 (Mar 2, 2021)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-73421
    Affects 5.0.0-beta.0 to 5.0.0-beta.31 (5.0.0-beta.32 is outside it)
  • CVE-2026-73420
    Affects 4.10.3 to 4.24.14 (4.24.15 is outside it); 5.0.0-beta.1 to 5.0.0-beta.31 (5.0.0-beta.32 is outside it)
  • CVE-2026-73419
    Affects 0.0.0-experimental.1e239999 to 4.24.14 (4.24.15 is outside it); 5.0.0-beta.1 to 5.0.0-beta.31 (5.0.0-beta.32 is outside it)
  • CVE-2026-73418
    Affects 4.0.6 to 4.24.14 (4.24.15 is outside it); 5.0.0-beta.0 to 5.0.0-beta.31 (5.0.0-beta.32 is outside it)
  • CVE-2023-48309
    Affects 0.0.0-experimental.1e239999 to 4.24.4 (4.24.5 is outside it)
  • CVE-2023-27490
    Affects 0.0.0-experimental.1e239999 to 4.20.0 (4.20.1 is outside it)
  • CVE-2022-35924
    Affects 0.0.0-experimental.1e239999 to 3.29.9 (3.29.10 is outside it); 4.0.1 to 4.10.2 (4.10.3 is outside it)
  • CVE-2022-31186
    Affects 0.0.0-experimental.1e239999 to 3.29.8 (3.29.9 is outside it); 4.0.1 to 4.10.1 (4.10.2 is outside it)
  • CVE-2022-31127
    Affects 0.0.0-experimental.1e239999 to 3.29.7 (3.29.8 is outside it); 4.0.1 to 4.8.0 (4.9.0 is outside it)
  • CVE-2022-31093
    Affects 0.0.0-experimental.1e239999 to 3.29.4 (3.29.5 is outside it); 4.0.1 to 4.4.0 (4.5.0 is outside it)
  • CVE-2022-29214
    Affects 0.0.0-experimental.1e239999 to 3.29.1 (3.29.3 is outside it); 4.0.1 to 4.3.2 (4.3.3 is outside it)
  • CVE-2022-24858
    Affects 0.0.0-experimental.1e239999 to 3.29.1 (3.29.3 is outside it); 4.0.1 to 4.3.1 (4.3.2 is outside it)
  • CVE-2021-21310
    Affects 0.0.0-experimental.1e239999 to 0.0.0-pr.11562.ed0fce23 (3.7.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 13

  • CVE-2026-73421Critical 9.1

    NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

    Affected: from 5.0.0-beta.0, fixed in 5.0.0-beta.32.

    Fixed in 5.0.0-beta.32 (released Jul 20, 2026, 24 days before disclosure).

    The latest release, 4.24.15, is not affected.

    14% of next-auth downloads last week were affected versions (1.5M).

  • CVE-2026-73420Critical 9.1

    NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

    Affected: from 4.10.3, fixed in 4.24.15; from 5.0.0-beta.1, fixed in 5.0.0-beta.32.

    Fixed in 4.24.15 (released Jul 20, 2026, 24 days before disclosure) and 5.0.0-beta.32 (released Jul 20, 2026, 24 days before disclosure).

    The latest release, 4.24.15, is not affected.

    40% of next-auth downloads last week were affected versions (4.1M).

  • CVE-2026-73419Medium 6.8

    NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

    Affected: from 5.0.0-beta.1, fixed in 5.0.0-beta.32; fixed in 4.24.15.

    Fixed in 4.24.15 (released Jul 20, 2026, 23 days before disclosure) and 5.0.0-beta.32 (released Jul 20, 2026, 23 days before disclosure).

    The latest release, 4.24.15, is not affected.

    40% of next-auth downloads last week were affected versions (4.1M).

  • NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

    Affected: from 5.0.0-beta.0, fixed in 5.0.0-beta.32; from 4.0.6, fixed in 4.24.15.

    Fixed in 4.24.15 (released Jul 20, 2026, 23 days before disclosure) and 5.0.0-beta.32 (released Jul 20, 2026, 23 days before disclosure).

    The latest release, 4.24.15, is not affected.

    40% of next-auth downloads last week were affected versions (4.1M).

  • CVE-2023-48309Medium 5.3

    next-auth vulnerable to possible user mocking that bypasses basic authentication

    Affected: fixed in 4.24.5.

    Fixed in 4.24.5 (released Nov 10, 2023, 10 days before disclosure).

    The latest release, 4.24.15, is not affected.

    1.1% of next-auth downloads last week were affected versions (109.3K).

  • Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth

    Affected: fixed in 4.20.1.

    Fixed in 4.20.1 (released Mar 2, 2023, 7 days before disclosure).

    The latest release, 4.24.15, is not affected.

    0.3% of next-auth downloads last week were affected versions (28.5K).

  • CVE-2022-35924Critical 9.1

    Verification requests (magic link) sent to unwanted emails

    Affected: from 4.0.0, fixed in 4.10.3; fixed in 3.29.10.

    Fixed in 3.29.10 (released Aug 1, 2022, 1 day before disclosure) and 4.10.3 (released Aug 1, 2022, 1 day before disclosure).

    The latest release, 4.24.15, is not affected.

    <0.1% of next-auth downloads last week were affected versions (10.2K).

  • Leakage of excessive information into log in next-auth

    Affected: fixed in 3.29.9; from 4.0.0, fixed in 4.10.2.

    Fixed in 3.29.9 (released Jul 25, 2022, 7 days before disclosure) and 4.10.2 (released Jul 21, 2022, 11 days before disclosure).

    The latest release, 4.24.15, is not affected.

    <0.1% of next-auth downloads last week were affected versions (10K).

  • Improper handling of email input in next-auth

    Affected: fixed in 3.29.8; from 4.0.0, fixed in 4.9.0.

    Fixed in 3.29.8 (released Jul 5, 2022, 1 day before disclosure) and 4.9.0 (released Jul 6, 2022, the day of disclosure).

    The latest release, 4.24.15, is not affected.

    <0.1% of next-auth downloads last week were affected versions (8.8K).

  • Improper Handling of `callbackUrl` parameter in next-auth

    Affected: fixed in 3.29.5; from 4.0.0, fixed in 4.5.0.

    Fixed in 3.29.5 (released Jun 20, 2022, 7 days before disclosure) and 4.5.0 (released Jun 12, 2022, 15 days before disclosure).

    The latest release, 4.24.15, is not affected.

    <0.1% of next-auth downloads last week were affected versions (8.4K).

  • CVE-2022-29214Medium 6.1

    URL Redirection to Untrusted Site ('Open Redirect') in next-auth

    Affected: fixed in 3.29.3; from 4.0.0, fixed in 4.3.3.

    Fixed in 3.29.3 (released Apr 26, 2022, 24 days before disclosure) and 4.3.3 (released Apr 20, 2022, 30 days before disclosure).

    The latest release, 4.24.15, is not affected.

    <0.1% of next-auth downloads last week were affected versions (7.5K).

  • CVE-2022-24858Medium 6.1

    Default redirect callback vulnerable to open redirects

    Affected: fixed in 3.29.2; from 4.0.0, fixed in 4.3.2.

    Fixed in 3.29.3 (released Apr 26, 2022, 7 days after disclosure, the advisory names 3.29.2, which was never published) and 4.3.2 (released Apr 14, 2022, 5 days before disclosure).

    The latest release, 4.24.15, is not affected.

    <0.1% of next-auth downloads last week were affected versions (7.4K).

  • CVE-2021-21310Medium 6.1

    Token verification bug in next-auth

    Affected: fixed in 3.3.0.

    Fixed in 3.7.0 (released Mar 2, 2021, 19 days after disclosure, the advisory names 3.3.0, which was never published).

    The latest release, 4.24.15, is not affected.

    <0.1% of next-auth downloads last week were affected versions (2.4K).