CVE-2026-40155: Auth0 Next.js SDK has Improper Proxy Cache Lookup

April 21, 2026

In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results.

References

github.com/advisories/GHSA-xq8m-7c5p-c2r6
github.com/auth0/nextjs-auth0/commit/98c36dc306970c2230ea1a32efef431d29b99978
github.com/auth0/nextjs-auth0/releases/tag/v4.18.0
github.com/auth0/nextjs-auth0/security/advisories/GHSA-xq8m-7c5p-c2r6
nvd.nist.gov/vuln/detail/CVE-2026-40155

Code Behaviors & Features

Detect and mitigate CVE-2026-40155 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →