npm / @auth0/nextjs-auth0
@auth0/nextjs-auth0
What changed in @auth0/nextjs-auth0 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
5 breaking17 security41 new APIs and options40 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@auth0/nextjs-auth0 4103 changes
Breaking changes 5
Session expiry errors are surfaced instead of being silently handled by session rotation.
Transaction cookies now include a timestamp prefix, creating a bounded rolling-deployment incompatibility window between v4.29.0 and v4.28.0.
Enterprise connections now enforce an IPSIE session_expiry ceiling.
Unintended class and type exports were removed from the SDK.
TokenRequestCache is removed when calling getAccessToken, changing how access-token requests are handled.
Security 17
createRouteUrl prevents open redirects by checking for cross-origin origins.
The request cookies are passed so stale transaction cookies can be evicted during enterprise login.
Updated Next.js to patched versions to address security vulnerabilities.
Insecure issuer URLs now preserve their ports.
Magic-link transactions now generate and store a nonce for ID token flows.
Refresh tokens are now revoked on logout.
Refresh tokens are revoked on logout in mTLS flows.
Per-request max_age is persisted in TransactionState to enforce auth-related behavior.
Deleted cookies now include Secure, SameSite, and HttpOnly attributes in Set-Cookie.
Logout now deletes the v3 appSession cookie.
Stale session reuse during proxy DPoP nonce retries was fixed.
Auth0 Next.js SDK has Improper Proxy Cache Lookup
Updated Next.js peer dependencies to address CVE-2025-55184 and CVE-2025-55183.
Improper Validation of Query Parameters in Auth0 Next.js SDK
Prevents OAuth parameter injection through returnTo.
Improper Request Caching Lookup in the Auth0 Next.js SDK
Connected Accounts use fetcher so DPoP is used properly.
New APIs and options 41
The package now ships agent skills for use with the technology.
Adds anonymous sessions with Session Transfer Ticket linking, available as an EA feature.
Added Enterprise Connect support for enterprise SSO flows.
Added typed parameters for selecting login experiments and variations.
Added route support for federated-domain checks.
Added federated-domain detection and login helpers.
Added support for listing and disconnecting connected accounts, including cleanup of orphaned cookies.
Added an optional login hint for connection token flows.
Session user data now exposes the optional My Organization permissions claim for use in application interfaces and UI authorization.
Added an API for revoking refresh tokens.
Added session transfer token support for CTE workflows.
Adds a passwordless database implementation for applications using Auth0 authentication.
CTE delegation was added.
MtlsError and MtlsErrorCode were added for handling Mutual TLS authentication errors.
Mutual TLS authentication support was added to the AuthClient and Auth0Client public API.
A predicate function parameter was added to allow selectively rolling sessions.
The auth0-client header can now be allow-listed for forwarding.
AuthorizationParameters now accepts connection for passwordless authentication flows.
AuthorizationParameters now accepts login_hint for passwordless authentication flows.
Error classes and types were added for passwordless authentication.
Next.js route handlers were added for passwordless authentication flows.
AuthClient now provides passwordlessStart for initiating passwordless authentication.
AuthClient now provides passwordlessVerify for completing passwordless authentication.
AuthorizationParameters now accepts screen_hint for passwordless authentication flows.
Access token routes can now be customized.
Profile routes can now be customized.
Adds reactive MFA step-up via Universal Login using a popup.
SessionDataStore now supports an optional update() method for updating session data.
Added support for multiple custom domains.
Adds support for dynamically determining the application base URL.
Adds an allow list for dynamic APP_BASE_URL configuration.
Adds an option for refreshing access tokens early.
The access-token endpoint now supports TTL and optionally returns the full client response.
MFA APIs were added, enabling developers to integrate multi-factor authentication capabilities.
Base MFA support was added for applications using the SDK.
Adds custom token exchange support for applications using the SDK.
Connected accounts now support the scopes parameter.
Adds Proxy handler support, enabling My Account and My Org.
Adds support for access tokens with different audiences through MRRT.
Adds support for connected accounts.
Adds support for Demonstrating Proof-of-Possession.
Fixes and other changes 40
Channel factor names are mapped to oob in mfaChallenge, correcting MFA challenge behavior.
Cookie attributes are preserved when refreshing from a Server Action.
The /me and /my-org endpoints return 401 instead of 500 when token refresh fails.
Middleware is now bound to the Auth0Client instance, fixing instance context issues.
Login-link prefetching was improved to avoid triggering unintended login flows.
Proxy URL construction now preserves query parameters that contain multiple values.
Transaction cookies now use FIFO eviction with a 3500-byte total size cap, preventing unbounded accumulation and 431 errors.
The state parameter is forwarded to the OIDC end-session URL during logout.
Interactive flow routing is corrected for mTLS.
Path-based issuer URLs no longer receive an added trailing slash.
MfaRequiredError is now surfaced from passkeyGetToken and passwordless verification flows.
Allows path-based domain URLs when using Okta custom authorization servers.
Domain validation now respects the allowInsecureRequests option.
Fixes MFA HTTP contract parity issues.
Skips MCD session backfill when running in static mode.
Fixed a race issue affecting DPoP nonce retries.
Construction is deferred when AUTH0_DOMAIN is not set at build time, preventing build-time failures.
Fixes a Next.js edge runtime build error involving the crypto module.
Prevents rolling sessions from re-creating a deleted session during concurrent logout.
Error details from HTTP 5xx OAuth responses are preserved.
Middleware no longer throws ERR_JWE_INVALID.
Made withPageAuthRequired generic to support PageProps and LayoutProps types.
Enabled full generic type inference so PageProps and LayoutProps propagate correctly.
Falsey values in authorization parameters are preserved instead of being stripped.
The SDK catches ERR_JWE_DECRYPTION_FAILED and ignores the cookie instead of throwing.
Using getAccessToken with refresh no longer causes a headers.append error in Next.js 16 proxy.
Fixed session writes for the Pages Router when using chunked cookies.
Updated the supported Next.js peer dependency versions.
Updated the supported React peer dependency versions.
Updated the supported React-DOM peer dependency versions.
Fixed broken Next.js 16 applications when basePath is used.
Adds support for Next 16.
Session changes are merged before finalizing the session after refresh.
TokenRequestCache is removed when calling getAccessToken.
The hook now receives the updated token after a token refresh.
Auth code callbacks now retry when a DPoP nonce is required.
Server helpers no longer depend on React, fixing bundling for edge runtimes.
Fixes updateSession behavior and related header overwrite issues.
with-next-intl now appends internationalization headers instead of overwriting existing headers.
The fetcher now honors token_type.