Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

🗓️ 23 Jul 2026 14:42:55Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 9 Views

getToken() throws on malformed Bearer; upgrade to patched version where invalid tokens return null.

Vulners

Node

nextauth.js next-authRange4.0.6–4.24.14npm

nextauth.js next-authRange5.0.0-beta.0–5.0.0-beta.31npm

auth coreRange0.1.0–0.41.3npm

Source	Link
github	www.github.com/nextauthjs/next-auth/security/advisories/GHSA-xmf8-cvqr-rfgj
github	www.github.com/nextauthjs/next-auth/pull/13467
github	www.github.com/nextauthjs/next-auth/pull/13469
github	www.github.com/nextauthjs/next-auth/commit/5bca2399a79ba8d116ca5179b4b1ebcd152e7f05
github	www.github.com/nextauthjs/next-auth/commit/e707770f00c52b3479e43422b0200b059149ed53
github	www.github.com/nextauthjs/next-auth/releases/tag/@auth/[email protected]
github	www.github.com/nextauthjs/next-auth/releases/tag/[email protected]
github	www.github.com/nextauthjs/next-auth/releases/tag/[email protected]
github	www.github.com/advisories/GHSA-xmf8-cvqr-rfgj

23 Jul 2026 14:43Current

5.5Medium risk

Vulners AI Score5.5