GHSA-wcgj-f865-c7j7
Improper Request Caching Lookup in the Auth0 Next.js SDK
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @auth0/nextjs-auth0 | >= 4.11.0, < 4.11.2 | 4.11.2 |
| npm | @auth0/nextjs-auth0 | >= 4.12.0, < 4.12.1 | 4.12.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Description
When using affected versions of the Next.js SDK, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results.
### Am I Affected?
You are affected if you meet the following preconditions:
- Applications using the auth0/nextjs-auth0 SDK with a singleton client instance, versions 4.11.0, 4.11.1, and 4.12.0.
### Affected product and versions
Auth0/nextjs-auth0 v4.11.0, v4.11.1, and v4.12.0.
### Resolution
Upgrade Auth0/nextjs-auth0 version to v4.11.2 or v4.12.1
### Acknowledgements
Okta would like to thank Joshua Rogers (MegaManSec) for their discovery and responsible disclosure.
References
External links from the advisory. They lead to third-party sites.