CVE-2025-67490: Improper Request Caching in Auth0 Next.js SDK
Summary
CVE-2025-67490: Improper Request Caching Lookup in the Auth0 Next.js SDK. Affects @auth0/nextjs-auth0 across 2 version ranges.
>= 4.11.0, < 4.11.2
>= 4.12.0, < 4.12.1
Fixed in 4.11.2 or 4.12.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Auth0 Next.js SDK is a popular library that simplifies the integration of Auth0 authentication into Next.js applications. It provides essential features such as user authentication, session management, and secure token handling. However, certain versions of this SDK are vulnerable to improper request caching, which can lead to security issues when handling simultaneous requests.
Vulnerability Detail
The vulnerability arises from improper lookups in the TokenRequestCache when multiple requests are made simultaneously using the same client instance. This can lead to unintended exposure of sensitive information or improper authentication states, potentially allowing unauthorized access to user data. The affected versions are 4.11.0, 4.11.1, and 4.12.0, which do not handle concurrent requests correctly, leading to potential security risks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.11.0, < 4.11.24.11.2npm install @auth0/nextjs-auth0@4.11.2 -
>= 4.12.0, < 4.12.14.12.1npm install @auth0/nextjs-auth0@4.12.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of a singleton client instance for the Auth0 Next.js SDK. Instead, create a new client instance for each request to mitigate the risk of improper caching.
Conclusion
In summary, CVE-2025-67490 is a vulnerability in the Auth0 Next.js SDK that can lead to improper request caching and potential security risks. Users are advised to upgrade to the latest patched versions to mitigate these risks. For those unable to upgrade immediately, a workaround is available to help reduce exposure.
See every vulnerability recorded for @auth0/nextjs-auth0 →
FAQ
The affected versions are 4.11.0, 4.11.1, and 4.12.0.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot upgrade immediately, consider implementing the workaround by avoiding the use of a singleton client instance.
The vulnerability was discovered by Joshua Rogers from MegaManSec, who also responsibly disclosed it.
References
Related vulnerabilities
Recent vulnerabilities recorded for @auth0/nextjs-auth0.
