Auth0 Next.js SDK has Improper Proxy Cache Lookup

Description

In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results.

Recommendation

Update the @auth0/nextjs-auth0 package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.12.0, <= 4.17.0
• Patched version(s): 4.18.0

References

• GHSA-xq8m-7c5p-c2r6
• CVE-2026-40155
• CWE-362
• CWE-863
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Improper Request Caching Lookup in the Auth0 Next.js SDK - CVE-2025-67490
• Improper Validation of Query Parameters in Auth0 Next.js SDK - CVE-2025-67716
• Auth.js SDK has Improper Permission Checking - CVE-2026-42280
• @payloadcms/next has Stored XSS in Admin Panel - CVE-2026-34748

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@auth0/nextjs-auth0