CVE-2026-73418: NextAuth.js DOS Vulnerability

CVE-2026-73418 Overview

CVE-2026-73418 is a denial-of-service vulnerability in NextAuth.js, the authentication library for Next.js applications. The flaw affects the getToken() helper exported from the next-auth/jwt and @auth/core/jwt modules. When no session cookie is present, getToken() URL-decodes the value of an Authorization: Bearer header before validating it. Malformed percent-encoding causes decodeURIComponent() to throw an uncaught exception rather than returning an invalid-token response. Because getToken() is commonly invoked from API routes, middleware, and server-side request handlers, a single crafted unauthenticated request can crash the request path that authenticates users.

Critical Impact
An unauthenticated attacker can trigger a per-request denial of service against any Next.js endpoint that calls getToken() by sending an Authorization: Bearer header with malformed percent-encoding.

Affected Products

@auth/core prior to 0.41.3
next-auth prior to 4.24.15
next-auth5.0.0-beta releases prior to 5.0.0-beta.32

Discovery Timeline

2026-08-12 - CVE-2026-73418 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73418

Vulnerability Analysis

The vulnerability is an improper input validation issue [CWE-20] in the JWT parsing path of NextAuth.js. The getToken() helper is designed to resolve a session from either a cookie or a bearer token. When the cookie is absent, it falls back to reading the Authorization header and decoding the value that follows the Bearer scheme. The decoding step assumes the header value is well-formed percent-encoded text. JavaScript's decodeURIComponent() raises a URIError when it encounters invalid escape sequences such as %ZZ or a trailing %. NextAuth did not wrap that call in a try/catch, so the exception propagated to the caller. Since getToken() is typically invoked at the top of request handlers and middleware, the exception terminates the request. An unauthenticated attacker with only network reachability to the application can send such requests repeatedly, degrading availability of any route that authenticates users.

Root Cause

The root cause is the missing exception handler around decodeURIComponent(urlEncodedToken) in the bearer-token branch of getToken(). Malformed input should have been treated as an invalid token, returning null. Instead, the decoder's exception surfaced to the request pipeline as an unhandled error.

Attack Vector

Exploitation requires only network access to a Next.js endpoint that calls getToken() and does not require authentication, user interaction, or elevated privileges. The attacker sends an HTTP request with an Authorization header such as Authorization: Bearer %ZZ and no valid session cookie. The vulnerability does not expose tokens, sessions, or other data, and it does not bypass authentication.

typescript

// Patch in packages/next-auth/src/jwt/index.ts
 if (!token && authorizationHeader?.split(" ")[0] === "Bearer") {
   const urlEncodedToken = authorizationHeader.split(" ")[1]
-  token = decodeURIComponent(urlEncodedToken)
+  try {
+    token = decodeURIComponent(urlEncodedToken)
+  } catch {
+    // Malformed percent-encoding makes the Bearer token invalid
+    // @ts-expect-error
+    return null
+  }
 }
// Source: https://github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05

An equivalent fix landed in packages/core/src/jwt.ts via commit e707770.

Detection Methods for CVE-2026-73418

Indicators of Compromise

HTTP requests carrying an Authorization: Bearer header whose value contains malformed percent-encoding, for example %, %Z, %ZZ, or a trailing % byte.
Application logs showing URIError: URI malformed originating in next-auth/jwt or @auth/core/jwt stack frames.
Bursts of 5xx responses from routes that invoke getToken(), correlated with unauthenticated source IPs.

Detection Strategies

Instrument middleware and API routes to log the request path, source IP, and truncated Authorization header when getToken() throws.
Alert on repeated URIError exceptions in Next.js server logs, especially from a single source or against authentication-adjacent endpoints.
Use a web application firewall or reverse proxy rule to flag Authorization: Bearer header values that contain invalid percent sequences.

Monitoring Recommendations

Track availability and error rates for endpoints protected by next-auth middleware to detect DoS patterns.
Forward Next.js server logs into a central log platform and build queries for URIError frames tied to next-auth or @auth/core.
Monitor package inventories for next-auth versions below 4.24.15, 5.0.0-beta.32, and @auth/core below 0.41.3.

How to Mitigate CVE-2026-73418

Immediate Actions Required

Upgrade next-auth to 4.24.15 (v4 line) or 5.0.0-beta.32 (v5 beta line).
Upgrade @auth/core to 0.41.3 for projects consuming Auth.js directly.
Redeploy all Next.js applications and serverless functions that bundle the affected package versions; cached build artifacts must be rebuilt.
Review error-handling middleware to ensure unhandled exceptions in authentication code do not crash worker processes.

Patch Information

The fix wraps decodeURIComponent() in a try/catch and returns null when the bearer token is malformed. It ships in @auth/core 0.41.3, next-auth 4.24.15, and next-auth 5.0.0-beta.32. See the GitHub Security Advisory GHSA-xmf8-cvqr-rfgj and pull request #13469 for the full patch set.

Workarounds

At an upstream proxy or WAF, drop or rewrite requests whose Authorization: Bearer value contains invalid percent-encoding before they reach the Next.js application.
Wrap calls to getToken() in a try/catch inside your middleware and API routes so a thrown URIError returns an HTTP 401 instead of a 500.
If bearer-token authentication is not required, strip the Authorization header at the edge for routes served by next-auth.

bash

# Upgrade to patched versions using npm
npm install next-auth@4.24.15
# or, for the v5 beta line
npm install next-auth@5.0.0-beta.32
# for Auth.js core consumers
npm install @auth/core@0.41.3