npm/next-auth CVE-2026-73421: critical, EPSS 0.64%
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
Action: Upgrade next-auth to 5.0.0-beta.32 or later.
npm i next-auth@5.0.0-beta.32Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0-beta.0 | 5.0.0-beta.32 | - |
Fixed versions
| 5.0.0-beta.32 |
Sources
- osv: GHSA-8fpg-xm3f-6cx3
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-8fpg-xm3f-6cx3
- https://github.com/nextauthjs/next-auth/commit/d008b9b764bf4b322a87e1822d1dda7789258d8f
- https://github.com/nextauthjs/next-auth
- https://github.com/nextauthjs/next-auth/releases/tag/next-auth@5.0.0-beta.32
CVE-2026-73421 · published · modified · JSON