Is next-auth 3.29 vulnerable?
npm · 10 releases from 3.29.0 to 3.29.10 · latest next-auth is 4.24.15 · checked 2 Nov 2026
Yes: 4 known advisories
Yes. next-auth 3.29.10, the last 3.29 release, is affected by 4 known security advisories (1 high, 3 medium), including CVE-2023-27490, CVE-2026-73419, CVE-2023-48309. 6 more affect earlier 3.29.x releases. Upgrade to 4.24.15 or later to fix all of them.
npm install next-auth@4.24.15Advisories affecting next-auth 3.29.10
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
- Affected
- >=5.0.0-beta.1 <5.0.0-beta.32 · <4.24.15
- Fixed in
- 4.24.15, 5.0.0-beta.32
NextAuthjs Email misdelivery Vulnerability
- Affected
- <4.24.12 · >=5.0.0-beta.0 <5.0.0-beta.30
- Fixed in
- 4.24.12, 5.0.0-beta.30
Possible user mocking that bypasses basic authentication
- Affected
- <4.24.5
- Fixed in
- 4.24.5
Missing proper state, nonce and PKCE checks for OAuth authentication
- Affected
- <4.20.1
- Fixed in
- 4.20.1
Fixed within 3.29.x, affecting earlier releases
next-auth before v4.10.2 and v3.29.9 leaks excessive information into log
- Affected
- <3.29.9 · >=4.0.0 <4.10.2
- Fixed in
- 3.29.9, 4.10.2
NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails
- Affected
- >=4.0.0 <4.10.3 · <3.29.10
- Fixed in
- 3.29.10, 4.10.3
Improper handling of email input
- Affected
- <3.29.8 · >=4.0.0 <4.9.0
- Fixed in
- 3.29.8, 4.9.0
Improper Handling of `callbackUrl` parameter in next-auth
- Affected
- <3.29.5 · >=4.0.0 <4.5.0
- Fixed in
- 3.29.5, 4.5.0
URL Redirection to Untrusted Site ('Open Redirect') in next-auth
- Affected
- <3.29.3 · >=4.0.0 <4.3.3
- Fixed in
- 3.29.3, 4.3.3
NextAuth.js default redirect callback vulnerable to open redirects
- Affected
- <3.29.2 · >=4.0.0 <4.3.2
- Fixed in
- 3.29.2, 4.3.2
Which of your client projects are still on next-auth 3.29?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact next-auth version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other next-auth versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.