next-auth@4.24.15

charmbracelet/gumnext-auth@4.24.15Jul 20, 2026by gustavovalverde

AI Summary

A security patch release for the 4.x line that addresses vulnerabilities, authentication cookie handling, and CommonJS compatibility issues.

Key Highlights

Malformed Bearer tokens now return `null` instead of throwing an error.
OAuth `state`, `nonce`, and PKCE cookies are bound to the specific provider.
Email addresses are Unicode-normalized (NFKC) to prevent homoglyph bypass attacks.
Explicitly configured `NEXTAUTH_URL` takes precedence over the auto-detected forwarded host.
CommonJS compatibility is restored by pinning the `uuid` dependency to version 11.1.1.

Full Release Notes

Security patch release for the 4.x line.

- `getToken()` now returns `null` instead of throwing when the `Authorization` header contains a malformed Bearer value.
- OAuth `state`, `nonce`, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry.
- Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph `@` bypass.
- An explicitly configured `NEXTAUTH_URL` now takes precedence over the auto-detected forwarded host in trusted-host mode.
- Restores CommonJS compatibility by pinning `uuid` to `^11.1.1`; the 14.x line is ESM-only and broke `require()` on Node versions below 20.19.