authkit-nextjs may let session cookies be cached in CDNs

Description

In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users.

Next.

Recommendation

Update the @workos-inc/authkit-nextjs package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.11.0
• Patched version(s): 2.11.1

References

• GHSA-p8pf-44ff-93gf
• CVE-2025-64762
• CWE-524
• CAPEC-310
• OWASP 2021-A6

Related Issues

• node-forge is vulnerable to ASN.1 OID Integer Truncation - CVE-2025-66030
• undici Denial of Service attack via bad certificate data - CVE-2025-47279
• @workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled - CVE-2024-51752
• @workos-inc/authkit-nextjs session replay vulnerability - CVE-2024-29901

Tags:

npm

@workos-inc/authkit-nextjs