Skip to content
OpenAdvisories
Medium · 5.4 CVE-2025-67490 EUVD-2025-202631GHSA-wcgj-f865-c7j7

Auth0 Next.js SDK has Improper Request Caching Lookup

Published Dec 10, 2025 · Updated Dec 11, 2025 · Assigned by GitHub_M

Description

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.

Affected products

VendorProductAffectedFixed
auth0 nextjs-auth0 >= 4.12.0, < 4.12.1, >= 4.11.0, < 4.11.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm @auth0/nextjs-auth0 >= 4.11.0, < 4.11.2 4.11.2 GHSA-wcgj-f865-c7j7
npm @auth0/nextjs-auth0 >= 4.12.0, < 4.12.1 4.12.1 GHSA-wcgj-f865-c7j7

References