CVE-2022-31127: Improper handling of email input in next-auth
Summary
CVE-2022-31127: Improper handling of email input. Affects next-auth across 2 version ranges.
< 3.29.8
>= 4.0.0, < 4.9.0
Fixed in 3.29.8 or 4.9.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
next-auth is an open-source authentication library for Node.js that provides a simple and secure way to implement authentication in web applications. It offers various authentication providers and supports features like session management, token-based authentication, and social authentication. However, a vulnerability has been discovered in next-auth related to the handling of email input.
Vulnerability Detail
The vulnerability in next-auth allows an attacker to pass a compromised input to the e-mail signin endpoint, which can contain malicious HTML. This can trick the e-mail server into sending a phishing email to the user. For example, an attacker can provide an email input like 'balazs@email.com, <a href="http://attacker.com">Before signing in, claim your money!</a>'. When the email is rendered in the HTML, the link to the attacker's site is included, potentially leading to a successful phishing attack. This vulnerability affects next-auth v3 users before version 3.29.8 and next-auth v4 users before version 4.8.0.
How To Fix
Latest published version: 4.24.15 as of 23 Oct 2026
npm install next-auth@4.24.15Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.29.83.29.8npm install next-auth@3.29.8 -
>= 4.0.0, < 4.9.04.9.0npm install next-auth@4.9.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to upgrade to the latest version, a workaround is available. The workaround involves sanitizing the 'email' parameter passed to the 'sendVerificationRequest' function and ensuring it is not rendered in the HTML body. If you have a custom 'sendVerificationRequest' implementation, make sure to exclude the 'email' parameter from the HTML body or sanitize it properly. Refer to the next-auth documentation on customizing emails for more information.
Conclusion
The vulnerability in next-auth related to the improper handling of email input can allow attackers to perform phishing attacks by tricking the e-mail server into sending malicious emails to users. To mitigate this vulnerability, it is recommended to upgrade to the latest version of next-auth. If upgrading is not feasible, follow the provided workaround and ensure proper sanitization of the 'email' parameter. For further support and assistance, you can contact DevNack.com.
See every vulnerability recorded for next-auth →
FAQ
This vulnerability affects next-auth v3 users before version 3.29.8 and next-auth v4 users before version 4.8.0.
An attacker can exploit this vulnerability to send phishing emails to users, potentially leading to further attacks or unauthorized access.
To fix this vulnerability, it is recommended to upgrade to the latest version of next-auth. Follow the provided steps in the 'how_to_fix' section for detailed instructions.
Yes, if you are unable to upgrade to the latest version, you can follow the workaround mentioned in the 'workaround' section. Make sure to sanitize the 'email' parameter properly.
You can find more information about this vulnerability in the next-auth documentation and the provided references section.
References
Related vulnerabilities
Recent vulnerabilities recorded for next-auth.
