CVE-2026-73418

Name of the Vulnerable Software and Affected Versions @auth/core versions prior to 0.41.3 next-auth versions prior to 4.24.15 next-auth versions prior to 5.0.0-beta.32

Description The getToken() function in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when processing a malformed Authorization: Bearer header. In cases where no session cookie is present, the function performs URL-decoding on the bearer value using decodeURIComponent() before validation. If the percent encoding is malformed, the function throws an exception instead of treating the token as invalid. Since this helper is frequently used in middleware, API routes, and server-side request handlers, a single unauthenticated request can trigger a per-request denial of service.

Recommendations Update @auth/core to version 0.41.3 or later. Update next-auth to version 4.24.15 or later. Update next-auth to version 5.0.0-beta.32 or later.