CVE-2024-73418: Unhandled Exception in getToken() causes DoS in Next-Auth

Vulnerability Overview The function throws an uncaught exception when handling a malformed Bearer Authorization header. Specifically, when reads a malformed Bearer Authorization header (e.g., ), it attempts to URL-decode the value and validate its content. If the decoded value contains invalid percent-encoded sequences, throws an exception rather than treating it as an invalid token. Since is typically called in API routes, middleware, and other request handlers, a single unauthenticated request can trigger an unhandled exception within the code path, leading to a denial of service. Scope of Impact Affected Versions: - (npm): - (npm): - - Conditions for Impact: - Using or exposing the same implementation. - The application directly calls (e.g., in Route Handlers, Middleware, or server-side request handlers). - The call is not wrapped in a local . Impact: - Denial of Service: Unauthenticated requests carrying malformed Bearer Authorization headers can cause unhandled exceptions in handlers invoking . - Scope: Limited to availability; tokens, sessions, or other data are not exposed, and authentication is not bypassed. Remediation Patch Versions: - (npm): - (npm): - - Temporary Workarounds: - Configuration Level: Treat exceptions thrown by as "no token," for example: - Simplification/Normalization: Normalize incoming headers at the edge (proxy, middleware) before they reach , rejecting those where the Bearer component is not a valid percent-encoded value. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High CVE ID: CVE-2024-73418 Weakness: CWE-20 Reporter: @deprour

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-73418: Unhandled Exception in getToken() causes DoS in Next-Auth

More from this source