Description

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T21:17:40.890Z",
  "pubdate": "2026-08-12T21:17:40.890Z",
  "executiveSummary": "An unhandled exception vulnerability exists in the exported getToken() helper function within the next-auth/jwt and @auth/core/jwt modules of NextAuth.js.\nThe vulnerability allows an unauthenticated remote attacker to trigger a per-request denial of service against applications utilizing vulnerable authentication checks.\nAffected products include NextAuth.js prior to next-auth 4.24.15, next-auth 5.0.0-beta.32, and @auth/core prior to 0.41.3.\nThe root cause stems from improper error handling during the URL decoding of malformed Authorization: Bearer headers when no session cookie is present, causing decodeURIComponent() to throw an uncaught exception.\nSuccessful exploitation results in application crashes or request failures in API routes, middleware, and server-side request handlers where getToken() is executed, disrupting service availability.\nNo data exposure, session theft, or authentication bypass capabilities are granted to the attacker as a result of this vulnerability.",
  "technicalDetails": "The vulnerability resides within the getToken() helper function implemented in the next-auth/jwt and @auth/core/jwt modules of NextAuth.js.\nWhen a client request lacks a valid session cookie, the getToken() function attempts to parse and validate any provided Authorization: Bearer header.\nDuring this process, the function performs a URL-decode operation on the bearer token value prior to validation.\nIf an attacker supplies a malformed percent-encoding sequence within the Authorization: Bearer header, the underlying JavaScript decodeURIComponent() function throws an uncaught exception.\nBecause the exception is unhandled within getToken(), it propagates up the call stack to the enclosing API routes, middleware, or server-side request handlers.\nAs getToken() is commonly integrated directly into request authentication flows, a single malicious HTTP request can disrupt the execution context for that request.\nThis leads to an unhandled exception crash or dropped request, causing a per-request denial of service condition.\nExploitation requires network exposure to endpoints that invoke getToken(), but does not require any prior authentication or special privileges.\nThe affected versions comprise @auth/core prior to 0.41.3, next-auth prior to 4.24.15, and next-auth version 5.0.0-beta branches prior to 5.0.0-beta.32.\nThe behavior is strictly limited to causing execution failure and service disruption without compromising confidentiality or integrity."
}