authkit-nextjs may let session cookies be cached in CDNs

Description

In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users.

Next.

Recommendation

Update the @workos-inc/authkit-nextjs package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.11.0
• Patched version(s): 2.11.1

References

• GHSA-p8pf-44ff-93gf
• CVE-2025-64762
• CWE-524
• CAPEC-310
• OWASP 2021-A6

Related Issues

• NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies - CVE-2025-48947
• @workos-inc/authkit-nextjs session replay vulnerability - CVE-2024-29901
• Auth0 NextJS SDK v4 Missing Session Invalidation - CVE-2025-46344
• @workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled - CVE-2024-51752

Tags:

npm

@workos-inc/authkit-nextjs