CVE-2026-73418 in next-auth
Summary
by MITRE • 08/12/2026
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in NextAuth.js represents a critical denial of service risk that affects versions prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32. This issue stems from the getToken() helper function which is commonly utilized across API routes, middleware, and server-side request handlers for authentication purposes. The flaw manifests when the function processes Authorization: Bearer headers containing malformed percent encoding sequences, specifically when no session cookie is present in the request context.
The technical implementation of this vulnerability involves the getToken() function's behavior when handling bearer tokens without session cookies. The function performs URL-decoding on the bearer value using decodeURIComponent() before proceeding with token validation, which creates an attack surface where malformed percent encoding causes the JavaScript runtime to throw uncaught exceptions rather than gracefully handling invalid tokens. This design flaw directly violates secure coding practices outlined in CWE-248 and aligns with ATT&CK technique T1499.004 for network denial of service.
The operational impact of this vulnerability is significant as it enables attackers to trigger per-request denial of service conditions without any compromise to authentication tokens, sessions, or sensitive data. The attack vector requires only a single malformed request containing improperly encoded bearer tokens, making it particularly dangerous in production environments where API endpoints are frequently accessed. This vulnerability effectively creates a resource exhaustion scenario where each malicious request causes the application to crash or terminate unexpectedly, impacting service availability while maintaining complete authentication security posture.
Mitigation strategies for this vulnerability involve upgrading to the patched versions @auth/core 0.41.3 and next-auth 4.24.15 or 5.0.0-beta.32 where the implementation properly handles malformed percent encoding without throwing exceptions. Organizations should also implement proper error handling patterns around authentication functions and consider adding middleware-level protections that catch and gracefully handle token parsing errors. The fix addresses the underlying CWE-704 vulnerability by ensuring that malformed inputs are handled gracefully rather than causing application termination, aligning with ATT&CK's defensive techniques for preventing service disruption attacks through proper input validation and error handling mechanisms.