The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 17, 2026 · NIST NVD

   Detected

   The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enab

2. Jun 17, 2026 · NIST NVD

   Updated

   The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enab

Affected

• cpe auth0/nextjs-auth0version unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-40155

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-40155

  The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users

  nvd.nist.gov

References

• Patch · github.com
• Product · github.com
• Vendor Advisory · github.com