@auth0/nextjs-auth0

Auth0 Next.js SDK

Latest 4.31.1

NPM

88%

Total Score

healthy

Frequent releases, active organizational maintenance, and build provenance outweigh limited workflow hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

The package uses prepack and prepare scripts, which are relevant install or publish-time behavior and warrant review, but the signal alone does not show harmful activity.

Workflow audit

All eight workflows were analyzed with no untrusted checkout or script-injection findings, and only one of 26 action references is unpinned. Two high-confidence bot-condition findings and two workflows with top-level write permissions remain workflow hygiene concerns.

Vulnerabilities

Title	Versions	Severity
CVE-2026-40155 @auth0/nextjs-auth0 is vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in versions 4.12.0 - 4.17.0.	4.12.0 - 4.17.0	Medium
CVE-2025-67716 @auth0/nextjs-auth0 is vulnerable to Incomplete List of Disallowed Inputs in versions 4.9.0 - 4.13.0.	4.9.0 - 4.13.0	Low
CVE-2025-67490 @auth0/nextjs-auth0 is vulnerable to Incorrect Authorization in versions 4.11.0 - 4.11.2 and 4.12.0 - 4.12.1.	4.11.0 - 4.11.24.12.0 - 4.12.1	Medium
CVE-2025-48947 @auth0/nextjs-auth0 is vulnerable to Use of Web Browser Cache Containing Sensitive Information in versions 4.0.1 - 4.6.0.	4.0.1 - 4.6.0	High
AIKIDO-2025-10276 @auth0/nextjs-auth0 is vulnerable to Insufficient Session Expiration in versions 4.0.2 - 4.5.0.	4.0.2 - 4.5.0	Medium