HIGH
nextauthjs
CVE published 2026-08-12
CVE-2026-73418
A vulnerability in NextAuth.js can cause an unhandled exception when reading a malformed Authorization: Bearer header, potentially leading to a denial of service. This issue arises from the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeU [truncated]