CVE-2026-40155

The record

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.

Affected packages

Related vulnerabilities

• GHSA-xq8m-7c5p-c2r6 Auth0 Next.js SDK has Improper Proxy Cache Lookup Same vulnerability
• CVE-2025-67716 The Auth0 Next.js SDK is a library for implementing user authentication in Next.js… Also affects @auth0/nextjs-auth0
• CVE-2025-67490 The Auth0 Next.js SDK is a library for implementing user authentication in Next.js… Also affects @auth0/nextjs-auth0
• GHSA-mr6f-h57v-rpj5 Improper Validation of Query Parameters in Auth0 Next.js SDK Also affects @auth0/nextjs-auth0
• GHSA-wcgj-f865-c7j7 Improper Request Caching Lookup in the Auth0 Next.js SDK Also affects @auth0/nextjs-auth0
• CVE-2026-114641 Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and… CWE-362
• CVE-2026-109279 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when… CWE-362
• CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder… CWE-362