From d33d2941cb81cdec6ce357f92e0ad1c5b884b330 Mon Sep 17 00:00:00 2001 From: Nikita Pivkin Date: Sun, 20 Sep 2026 01:16:26 +0600 Subject: [PATCH 1/2] Improve GHSA-xq8m-7c5p-c2r6 --- .../2026/04/GHSA-xq8m-7c5p-c2r6/GHSA-xq8m-7c5p-c2r6.json | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/advisories/github-reviewed/2026/04/GHSA-xq8m-7c5p-c2r6/GHSA-xq8m-7c5p-c2r6.json b/advisories/github-reviewed/2026/04/GHSA-xq8m-7c5p-c2r6/GHSA-xq8m-7c5p-c2r6.json index fc02b1583cf9..0a10b9f244a1 100644 --- a/advisories/github-reviewed/2026/04/GHSA-xq8m-7c5p-c2r6/GHSA-xq8m-7c5p-c2r6.json +++ b/advisories/github-reviewed/2026/04/GHSA-xq8m-7c5p-c2r6/GHSA-xq8m-7c5p-c2r6.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-xq8m-7c5p-c2r6", - "modified": "2026-04-21T15:21:46Z", + "modified": "2026-04-21T15:21:47Z", "published": "2026-04-21T15:21:46Z", "aliases": [ "CVE-2026-40155" ], "summary": "Auth0 Next.js SDK has Improper Proxy Cache Lookup", - "details": "### Description\nIn affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results.\n\n### Which Projects are Affected?\nUsers are affected if they meet all of the following preconditions:\n- Applications using the auth0/nextjs-auth0 SDK, versions 4.12.0 to 4.17.0, and\n- Applications using the proxy handler /me/* and /my-org/* with DPoP enabled.\n\n\n### Affected product and versions\nAuth0/nextjs-auth0 v4.12.0 to 4.17.0\n\n### Resolution\nUpgrade Auth0/nextjs-auth0 version to v4.18.0 or greater\n\n### Acknowledgements\nOkta would like to thank Reynaldo Immanuel for their discovery and responsible disclosure.", + "details": "### Description\nIn affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results.\n\n### Which Projects are Affected?\nUsers are affected if they meet all of the following preconditions:\n- Applications using the auth0/nextjs-auth0 SDK, versions versions 4.12.0 to 4.17.1, and\n- Applications using the proxy handler /me/* and /my-org/* with DPoP enabled.\n\n\n### Affected product and versions\nAuth0/nextjs-auth0 v4.12.0 to 4.17.1\n\n### Resolution\nUpgrade Auth0/nextjs-auth0 version to v4.18.0 or greater\n\n### Acknowledgements\nOkta would like to thank Reynaldo Immanuel for their discovery and responsible disclosure.", "severity": [ { "type": "CVSS_V3", @@ -32,10 +32,7 @@ } ] } - ], - "database_specific": { - "last_known_affected_version_range": "<= 4.17.0" - } + ] } ], "references": [ From 33e4bd36fcf32e6670e0ff3dc9b423bab2ceed9d Mon Sep 17 00:00:00 2001 From: Nikita Pivkin Date: Sun, 20 Sep 2026 01:17:38 +0600 Subject: [PATCH 2/2] Improve GHSA-xq8m-7c5p-c2r6 --- .../2026/04/GHSA-xq8m-7c5p-c2r6/GHSA-xq8m-7c5p-c2r6.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/advisories/github-reviewed/2026/04/GHSA-xq8m-7c5p-c2r6/GHSA-xq8m-7c5p-c2r6.json b/advisories/github-reviewed/2026/04/GHSA-xq8m-7c5p-c2r6/GHSA-xq8m-7c5p-c2r6.json index 0a10b9f244a1..874eef2e3874 100644 --- a/advisories/github-reviewed/2026/04/GHSA-xq8m-7c5p-c2r6/GHSA-xq8m-7c5p-c2r6.json +++ b/advisories/github-reviewed/2026/04/GHSA-xq8m-7c5p-c2r6/GHSA-xq8m-7c5p-c2r6.json @@ -7,7 +7,7 @@ "CVE-2026-40155" ], "summary": "Auth0 Next.js SDK has Improper Proxy Cache Lookup", - "details": "### Description\nIn affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results.\n\n### Which Projects are Affected?\nUsers are affected if they meet all of the following preconditions:\n- Applications using the auth0/nextjs-auth0 SDK, versions versions 4.12.0 to 4.17.1, and\n- Applications using the proxy handler /me/* and /my-org/* with DPoP enabled.\n\n\n### Affected product and versions\nAuth0/nextjs-auth0 v4.12.0 to 4.17.1\n\n### Resolution\nUpgrade Auth0/nextjs-auth0 version to v4.18.0 or greater\n\n### Acknowledgements\nOkta would like to thank Reynaldo Immanuel for their discovery and responsible disclosure.", + "details": "### Description\nIn affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results.\n\n### Which Projects are Affected?\nUsers are affected if they meet all of the following preconditions:\n- Applications using the auth0/nextjs-auth0 SDK, versions 4.12.0 to 4.17.1, and\n- Applications using the proxy handler /me/* and /my-org/* with DPoP enabled.\n\n\n### Affected product and versions\nAuth0/nextjs-auth0 v4.12.0 to 4.17.1\n\n### Resolution\nUpgrade Auth0/nextjs-auth0 version to v4.18.0 or greater\n\n### Acknowledgements\nOkta would like to thank Reynaldo Immanuel for their discovery and responsible disclosure.", "severity": [ { "type": "CVSS_V3",