next-auth@4.24.15
astral-sh/uvnext-auth@4.24.15Jul 20, 2026by gustavovalverde
AI Summary
A security patch release for NextAuth 4.x that fixes Bearer token parsing, OAuth cookie binding, and restores CommonJS compatibility.
Key Highlights
- Security patch release
- Fixed Bearer token parsing to return null instead of throwing
- Fixed OAuth cookie binding to provider
- Fixed homoglyph email bypass vulnerability
- Restored CommonJS compatibility
Breaking Changes
- `getToken()` now returns `null` instead of throwing
- Potential temporary auth failures on upgrade retry
New Features
- Security fixes
- Compatibility improvements
Full Release Notes
Security patch release for the 4.x line. - `getToken()` now returns `null` instead of throwing when the `Authorization` header contains a malformed Bearer value. - OAuth `state`, `nonce`, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry. - Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph `@` bypass. - An explicitly configured `NEXTAUTH_URL` now takes precedence over the auto-detected forwarded host in trusted-host mode. - Restores CommonJS compatibility by pinning `uuid` to `^11.1.1`; the 14.x line is ESM-only and broke `require()` on Node versions below 20.19.