Improper Request Caching Lookup in the Auth0 Next.js SDK

Description

When using affected versions of the Next.js SDK, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results.

Recommendation

Update the @auth0/nextjs-auth0 package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.12.0, < 4.12.1

  >= 4.11.0, < 4.11.2**

• Patched version(s): **4.12.1

  4.11.2**

References

• GHSA-wcgj-f865-c7j7
• CVE-2025-67490
• CWE-863
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Improper Validation of Query Parameters in Auth0 Next.js SDK - CVE-2025-67716
• authkit-nextjs may let session cookies be cached in CDNs - CVE-2025-64762
• @perfood/couch-auth may expose session tokens, passwords - CVE-2025-60794
• NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies - CVE-2025-48947

Tags:

npm

@auth0/nextjs-auth0