authkit-nextjs may let session cookies be cached in CDNs

Description

In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users.

Next.

Recommendation

Update the @workos-inc/authkit-nextjs package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.11.0
• Patched version(s): 2.11.1

References

• GHSA-p8pf-44ff-93gf
• CVE-2025-64762
• CWE-524
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Improper Request Caching Lookup in the Auth0 Next.js SDK - CVE-2025-67490
• @perfood/couch-auth may expose session tokens, passwords - CVE-2025-60794
• undici Denial of Service attack via bad certificate data - CVE-2025-47279
• @workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled - CVE-2024-51752

Tags:

npm

@workos-inc/authkit-nextjs