NextAuth.js, an authentication library for Next.js, has an input validation vulnerability (CWE-20) in the getToken() helper function exported by next-auth/jwt and @auth/core/jwt modules. When no session cookie is present, getToken() URL-decodes the bearer token from the Authorization header. Malformed percent-encoding in the token causes decodeURIComponent() to throw an uncaught exception instead of treating the token as invalid. Because getToken() is commonly used in API routes, middleware, and server-side handlers, this can cause a denial of service by crashing these processes on a single unauthenticated request. The vulnerability does not expose tokens, sessions, or data, nor does it bypass authentication. It is fixed in @auth/core 0.41.3, next-auth 4.24.15, and 5.0.0-beta.32.

An attacker can cause a denial of service by sending a single unauthenticated request with a malformed Authorization: Bearer header, triggering an unhandled exception in server-side authentication code. This disrupts service availability but does not compromise confidentiality or integrity of tokens or sessions, nor does it allow authentication bypass.

This vulnerability is fixed in @auth/core version 0.41.3, next-auth version 4.24.15, and 5.0.0-beta.32. Users should upgrade to these or later versions to remediate the issue. No other mitigation is required as the vulnerability is addressed by the official fix.