Executive brief
A vulnerability in the Auth.js (formerly NextAuth.js) library can allow an unauthenticated attacker to crash a web application. By sending a specially crafted, malformed authorization header, an attacker can trigger an unhandled error that takes the affected service offline. This issue impacts the availability of the application but does not result in the theft of user data or a bypass of security controls.
Technical details
The `getToken()` helper in `@auth/core/jwt` and `next-auth/jwt` fails to properly validate input before performing URL decoding. When a request contains a malformed `Authorization: Bearer` header with invalid percent-encoding, the decoding process throws an uncaught exception instead of returning a null token. An unauthenticated remote attacker can exploit this by sending a single malicious request to any endpoint using `getToken()` (such as middleware or API routes) without a try/catch block, leading to a denial of service. The issue is resolved in `@auth/core` v0.41.3, `next-auth` v4.24.15, and `next-auth` v5.0.0-beta.32.
Affected products
- Auth.js @auth/core >= 0.1.0, < 0.41.3
- Auth.js next-auth >= 4.0.6, <= 4.24.14; >= 5.0.0-beta.0, <= 5.0.0-beta.31
Timeline
- 2026-07-20: disclosed: Initial disclosure to vendor
- 2026-07-23: advisory: GitHub Advisory published