Loading...
Skip to main content
GeekWala

CVE-2025-48947 — Vulnerability in @auth0/nextjs-auth0 — CVE Details

HIGH

NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

Published June 4, 2025Updated June 4, 2025Source: osv

Summary

**Overview** In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, __session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. **Am I Affected?** You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0, 2. Applications using CDN or edge caching that caches responses with the Set-Cookie header. 3. If the Cache-Control header is not properly set for sensitive responses. **Fix** Upgrade auth0/nextjs-auth0 to v4.6.1.

Advisory Timeline

  • First published June 4, 2025 (495 days ago).
  • Last revised June 4, 2025 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm
Update @auth0/nextjs-auth0 to 4.6.1 or later
npm install @auth0/nextjs-auth0@4.6.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: npm (1).

PackageEcosystemAffectedFixed In
@auth0/nextjs-auth0
npm
All versions4.6.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.2 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

References

Frequently Asked Questions

What is CVE-2025-48947?
NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.2/10).
How do I check if my project is affected by CVE-2025-48947?
CVE-2025-48947 affects @auth0/nextjs-auth0. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-48947 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.2

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-f3fg-mf2q-fj3f

Related CVEs

  • CVE-2026-107375
    HIGH

    JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

  • CVE-2026-107384
    HIGH

    MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

More npm advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies