@auth/core@0.41.3

nextauthjs/next-auth@auth/core@0.41.3Jul 20, 2026by Bekacru

AI Summary

Core update containing security and bugfix improvements, including enhanced OAuth cookie security, email validation normalization, and dependency management fixes.

Key Highlights

OAuth cookies (state, nonce, PKCE) are now bound to the provider that created them
Email addresses are Unicode-normalized (NFKC) to prevent homoglyph bypass
getToken() now returns null instead of throwing when the Authorization header is malformed

Full Release Notes

## Bugfixes

- **core**: `getToken()` now returns `null` instead of throwing when the `Authorization` header contains a malformed Bearer value
- **core**: OAuth `state`, `nonce`, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback
- **core**: email addresses are Unicode-normalized (NFKC) before validation in the default email normalizer, closing a homoglyph `@` bypass

## Other

- **deps**: resolve Dependabot alerts via cross-major dependency upgrades (#13449)
- **deps**: resolve Dependabot security advisories via pnpm overrides (#13441)
- **deps**: allow nodemailer 8 in peer dependency ranges (#13434)
- CI formatting and proxy deploy repairs (#13444)