CVE-2025-64762: authkit-nextjs Session Cookie Caching Vulnerability
Summary
CVE-2025-64762: authkit-nextjs may let session cookies be cached in CDNs. Affects @workos-inc/authkit-nextjs versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
authkit-nextjs is a package designed for integrating authentication in Next.js applications, providing developers with tools to manage user sessions securely. The package simplifies the process of handling authentication tokens and user sessions, ensuring that applications can maintain user states effectively. However, certain versions of this package have been found to be vulnerable to caching issues that can expose sensitive session information.
Vulnerability Detail
In authkit-nextjs version 2.11.0 and below, authenticated responses do not implement anti-caching headers, which can lead to session tokens being cached by CDNs. This vulnerability allows unauthorized users to potentially access another user's session token if the cached response is served to them. The risk is particularly pronounced in environments where CDN caching is enabled, and it depends on the deployment configuration and caching policies in place.
How To Fix
Minimum fixed version
2.11.1
This is the first release that contains the fix.
npm install @workos-inc/authkit-nextjs@2.11.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application code and middleware set appropriate Cache-Control headers for authenticated routes. For example, you can add the following headers in your Next.js API routes:
export default function handler(req, res) {
res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
res.setHeader('Pragma', 'no-cache');
res.setHeader('Expires', '0');
// Your authentication logic here
}
Conclusion
The authkit-nextjs package has a significant vulnerability that can lead to session token caching, potentially exposing sensitive user information. It is crucial to update to version 2.11.1 or later to mitigate this risk. Additionally, implementing proper caching headers can serve as a temporary workaround while ensuring application security.
See every vulnerability recorded for @workos-inc/authkit-nextjs →
FAQ
The impact includes the potential for unauthorized users to access another user's session token, which can lead to session hijacking.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, implement the recommended Cache-Control headers as a temporary measure to prevent caching of sensitive information.
Next.js applications deployed on Vercel are not affected unless CDN caching is manually enabled by setting cache headers on authenticated paths.
Vulert monitors and alerts for open-source vulnerabilities in your software by analyzing the package-lock.json file, providing real-time insights into potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for @workos-inc/authkit-nextjs.
