CVE-2022-35924
1 advisory.
npm/next-auth CVE-2022-35924: critical 9.1, EPSS 1.47%
NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails
Action: Upgrade next-auth to 3.29.10 or later.
npm i next-auth@4.10.3npm i next-auth@3.29.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.10.3 | - |
| 0 | 3.29.10 | - |
Fixed versions
| 4.10.3 | 3.29.10 |
Sources
- osv: GHSA-xv97-c62v-4587
- https://github.com/nextauthjs/next-auth/security/advisories/GHSA-xv97-c62v-4587
- https://nvd.nist.gov/vuln/detail/CVE-2022-35924
- https://github.com/nextauthjs/next-auth/commit/afb1fcdae3cc30445038ef588e491d139b916003
- https://en.wikipedia.org/wiki/Email_address#Local-part
- https://github.com/nextauthjs/next-auth
- https://next-auth.js.org/configuration/callbacks#sign-in-callback
- https://next-auth.js.org/configuration/initialization#advanced-initialization
- https://next-auth.js.org/providers/email
- https://next-auth.js.org/providers/email#normalizing-the-e-mail-address
- https://next-auth.js.org/providers/email#normalizing-the-email-address
- https://nodemailer.com/message/addresses
CVE-2022-35924 · published · modified · JSON