[GHSA-xq8m-7c5p-c2r6] Auth0 Next.js SDK has Improper Proxy Cache Lookup

[nikpivkin]

Updates

• Affected products
• Description

Comments
The range should end at < 4.18.0, not <= 4.17.0. The description is updated to say 4.17.1 as well.

The fix auth0/nextjs-auth0@98c36dc (#2580) is in tag v4.18.0 and not in tag v4.17.1. Version 4.17.1 came out one day before the fix, and its release notes only list two build fixes (#2604, #2564).

So version 4.17.1 is still vulnerable but is outside the current range.

[github]

Hi there @jennyyang-okta! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[github]

Hi there @jennyyang-okta! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Copilot review overview

🟢 Approval recommended

The vulnerability range is corrected consistently, with only a minor duplicated-word typo remaining.

Review effort: Balanced
Findings: 1

Open (1)

• Remove duplicated word in affected-version description · New

What changed in this PR

Updates the Auth0 Next.js SDK advisory to include vulnerable version 4.17.1.

Changes:

• Extends the documented affected range through 4.17.1.
• Removes the obsolete last-known-affected range.

File	Description
GHSA-xq8m-7c5p-c2r6.json	Corrects affected-version metadata and description.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.