CVE-2026-73418

Received Received - Intake

Exception in getToken() with Malformed Authorization Header in NextAuth.js

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73418

EUVD

EUVD-2026-57552

Affected Vendors & Products

Vendor	Product	Version / Range
auth	core	0.41.3
next_auth	next_auth	4.24.15
next_auth	next_auth	5.0.0-beta.32

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability affects NextAuth.js, a popular authentication library for Next.js. The issue is in the getToken() function which can throw an uncaught exception when processing a malformed Authorization header. Specifically, if the header contains invalid percent encoding, the function fails before validating the token, causing a denial of service.

Impact Analysis

This vulnerability can cause your application to crash or become unresponsive for every request that triggers the error. Since getToken() is commonly used in API routes and middleware, even unauthenticated requests can lead to service disruption without exposing sensitive data.

Mitigation Strategies

Update to patched versions: @auth/core 0.41.3 or next-auth 4.24.15 or 5.0.0-beta.32. This fixes the issue where getToken() throws an uncaught exception on malformed Authorization headers.

Hi! I’m here to help you understand CVE-2026-73418. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70