next-auth@4.24.15
ysharma3501/LuxTTSnext-auth@4.24.15Jul 20, 2026by gustavovalverde
Upgrading?
Release notes summary
A security patch release addressing vulnerabilities related to token handling, OAuth cookies, and email validation.
Key Highlights
- `getToken()` returns `null` instead of throwing on malformed Bearer tokens.
- OAuth cookies are now bound to the specific provider to prevent cross-provider attacks.
- Email addresses are Unicode-normalized to prevent homoglyph bypass.
- CommonJS compatibility is restored by pinning the `uuid` package.
New Features
- Restored CommonJS compatibility via `uuid` pinning.
Full Release Notes
Security patch release for the 4.x line. - `getToken()` now returns `null` instead of throwing when the `Authorization` header contains a malformed Bearer value. - OAuth `state`, `nonce`, and PKCE check cookies are now bound to the provider that created them and are rejected when a different provider handles the callback. Sign-ins in flight across the upgrade fail once and succeed on retry. - Email addresses are Unicode-normalized (NFKC) before validation in the email sign-in flow, closing a homoglyph `@` bypass. - An explicitly configured `NEXTAUTH_URL` now takes precedence over the auto-detected forwarded host in trusted-host mode. - Restores CommonJS compatibility by pinning `uuid` to `^11.1.1`; the 14.x line is ESM-only and broke `require()` on Node versions below 20.19.
Related Repositories
public-apis/public-apis★ 491,691
A collective list of free APIs
NousResearch/hermes-agent★ 256,554
The agent that grows with you
yt-dlp/yt-dlp★ 201,036
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,841
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,720
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.