Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 29 October 2025.

Which products and versions are affected?

next-auth (npm) SEMVER:introduced=0,fixed=4.24.12.

Is there a fix for This vulnerability?

Yes. next-auth (npm): upgrade to 4.24.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

NextAuth.js email misdelivery via nodemailer address parser bug

Severity: medium · CVSS 4 · Published 2025-10-29

NextAuth.js is an authentication framework for web applications that supports email-based sign-in. A parsing bug in its email handling library (nodemailer) allows attackers to craft malicious email addresses that redirect login and verification emails to attacker-controlled mailboxes instead of the intended recipients. An attacker can exploit this to intercept sensitive authentication tokens and account verification links meant for legitimate users.

Technologies: next-auth (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 29 October 2025.
Which products and versions are affected?: next-auth (npm) SEMVER:introduced=0,fixed=4.24.12.
Is there a fix for This vulnerability?: Yes. next-auth (npm): upgrade to 4.24.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run next-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

next-auth (npm): upgrade to 4.24.12 or later
```
npm install next-auth@4.24.12
```

Technical details

The vulnerability is rooted in nodemailer's RFC 5321/5322 non-compliant email address parser. When processing email sign-in requests, NextAuth.js passes user-supplied email addresses to nodemailer for sending authentication emails. A crafted input such as "e@attacker.com"@victim.com is misparsed, resulting in the message being delivered to e@attacker.com (attacker-controlled) instead of the intended recipient at victim.com. This occurs because the parser incorrectly handles quoted strings in email addresses. No authentication is required; the vulnerability is exploitable by submitting a malicious email address via the sign-in form. An attacker can receive login links, password reset tokens, or email verification codes intended for a victim. The vulnerability is patched in NextAuth.js versions 4.24.12 and 5.0.0-beta.30 by updating to nodemailer 7.0.7 or later.

Affected products

NextAuthjs next-auth <4.24.12, <5.0.0-beta.30

Timeline

2025-10-29: disclosed: Advisory GHSA-5jpx-9hw9-2fx4 published
2025-10-27: patched: Patches released in next-auth 4.24.12 and 5.0.0-beta.30

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.