CVE-2025-48947: NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies

(updated )

Overview In Auth0 Next.js SDK versions 4.0.1 to 4.6.0, __session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

  1. Applications using the NextJS-Auth0 SDK, versions between 4.0.1 to 4.6.0,
  2. Applications using CDN or edge caching that caches responses with the Set-Cookie header.
  3. If the Cache-Control header is not properly set for sensitive responses.

Fix Upgrade auth0/nextjs-auth0 to v4.6.1.

References

Code Behaviors & Features

Detect and mitigate CVE-2025-48947 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →