# What changed in @auth0/nextjs-auth0

> 103 changes in @auth0/nextjs-auth0 4 from its official release notes, upgrade guides and advisories: 5 breaking, 17 security, 41 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/@auth0/nextjs-auth0/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @auth0/nextjs-auth0 4

### Breaking changes

- Session expiry errors are surfaced instead of being silently handled by session rotation. (4.31.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.31.1)
- Transaction cookies now include a timestamp prefix, creating a bounded rolling-deployment incompatibility window between v4.29.0 and v4.28.0. (4.29.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.29.0)
- Enterprise connections now enforce an IPSIE session_expiry ceiling. (4.24.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.24.0)
- Unintended class and type exports were removed from the SDK. (4.14.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.14.1)
- TokenRequestCache is removed when calling getAccessToken, changing how access-token requests are handled. (4.11.2) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.11.2)

### Security

- createRouteUrl prevents open redirects by checking for cross-origin origins. (4.32.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.32.0)
- The request cookies are passed so stale transaction cookies can be evicted during enterprise login. (4.31.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.31.1)
- Updated Next.js to patched versions to address security vulnerabilities. (4.28.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.28.0)
- Insecure issuer URLs now preserve their ports. (4.26.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.26.0)
- Magic-link transactions now generate and store a nonce for ID token flows. (4.26.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.26.0)
- Refresh tokens are now revoked on logout. (4.26.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.26.0)
- Refresh tokens are revoked on logout in mTLS flows. (4.23.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.23.1)
- Per-request max_age is persisted in TransactionState to enforce auth-related behavior. (4.23.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.23.1)
- Deleted cookies now include Secure, SameSite, and HttpOnly attributes in Set-Cookie. (4.21.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.21.0)
- Logout now deletes the v3 appSession cookie. (4.20.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.20.0)
- Stale session reuse during proxy DPoP nonce retries was fixed. (4.20.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.20.0)
- Auth0 Next.js SDK has Improper Proxy Cache Lookup (4.18.0) — [security advisory](https://github.com/advisories/GHSA-XQ8M-7C5P-C2R6)
- Updated Next.js peer dependencies to address CVE-2025-55184 and CVE-2025-55183. (4.13.3) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.13.3)
- Improper Validation of Query Parameters in Auth0 Next.js SDK (4.13.0) — [security advisory](https://github.com/advisories/GHSA-MR6F-H57V-RPJ5)
- Prevents OAuth parameter injection through returnTo. (4.13.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.13.0)
- Improper Request Caching Lookup in the Auth0 Next.js SDK (4.11.2, 4.12.1) — [security advisory](https://github.com/advisories/GHSA-WCGJ-F865-C7J7)
- Connected Accounts use fetcher so DPoP is used properly. (4.11.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.11.0)

### New APIs and options

- The package now ships agent skills for use with the technology. (4.31.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.31.1)
- Adds anonymous sessions with Session Transfer Ticket linking, available as an EA feature. (4.31.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.31.0)
- Added Enterprise Connect support for enterprise SSO flows. (4.30.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.30.0)
- Added typed parameters for selecting login experiments and variations. (4.30.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.30.0)
- Added route support for federated-domain checks. (4.30.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.30.0)
- Added federated-domain detection and login helpers. (4.30.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.30.0)
- Added support for listing and disconnecting connected accounts, including cleanup of orphaned cookies. (4.28.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.28.0)
- Added an optional login hint for connection token flows. (4.28.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.28.0)
- Session user data now exposes the optional My Organization permissions claim for use in application interfaces and UI authorization. (4.27.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.27.0)
- Added an API for revoking refresh tokens. (4.26.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.26.0)
- Added session transfer token support for CTE workflows. (4.26.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.26.0)
- Adds a passwordless database implementation for applications using Auth0 authentication. (4.25.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.25.0)
- CTE delegation was added. (4.23.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.23.0)
- MtlsError and MtlsErrorCode were added for handling Mutual TLS authentication errors. (4.23.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.23.0)
- Mutual TLS authentication support was added to the AuthClient and Auth0Client public API. (4.23.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.23.0)
- A predicate function parameter was added to allow selectively rolling sessions. (4.23.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.23.0)
- The auth0-client header can now be allow-listed for forwarding. (4.21.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.21.0)
- AuthorizationParameters now accepts connection for passwordless authentication flows. (4.21.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.21.0)
- AuthorizationParameters now accepts login_hint for passwordless authentication flows. (4.21.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.21.0)
- Error classes and types were added for passwordless authentication. (4.21.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.21.0)
- Next.js route handlers were added for passwordless authentication flows. (4.21.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.21.0)
- AuthClient now provides passwordlessStart for initiating passwordless authentication. (4.21.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.21.0)
- AuthClient now provides passwordlessVerify for completing passwordless authentication. (4.21.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.21.0)
- AuthorizationParameters now accepts screen_hint for passwordless authentication flows. (4.21.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.21.0)
- Access token routes can now be customized. (4.20.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.20.0)
- Profile routes can now be customized. (4.20.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.20.0)
- Adds reactive MFA step-up via Universal Login using a popup. (4.19.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.19.0)
- SessionDataStore now supports an optional update() method for updating session data. (4.18.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.18.0)
- Added support for multiple custom domains. (4.17.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.17.0)
- Adds support for dynamically determining the application base URL. (4.16.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.16.0)
- Adds an allow list for dynamic APP_BASE_URL configuration. (4.16.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.16.0)
- Adds an option for refreshing access tokens early. (4.16.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.16.0)
- The access-token endpoint now supports TTL and optionally returns the full client response. (4.15.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.15.0)
- MFA APIs were added, enabling developers to integrate multi-factor authentication capabilities. (4.15.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.15.0)
- Base MFA support was added for applications using the SDK. (4.15.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.15.0)
- Adds custom token exchange support for applications using the SDK. (4.14.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.14.0)
- Connected accounts now support the scopes parameter. (4.13.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.13.0)
- Adds Proxy handler support, enabling My Account and My Org. (4.12.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.12.0)
- Adds support for access tokens with different audiences through MRRT. (4.11.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.11.0)
- Adds support for connected accounts. (4.11.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.11.0)
- Adds support for Demonstrating Proof-of-Possession. (4.11.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.11.0)

### Fixes and other changes

- Channel factor names are mapped to oob in mfaChallenge, correcting MFA challenge behavior. (4.32.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.32.1)
- Cookie attributes are preserved when refreshing from a Server Action. (4.32.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.32.0)
- The /me and /my-org endpoints return 401 instead of 500 when token refresh fails. (4.32.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.32.0)
- Middleware is now bound to the Auth0Client instance, fixing instance context issues. (4.30.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.30.0)
- Login-link prefetching was improved to avoid triggering unintended login flows. (4.29.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.29.0)
- Proxy URL construction now preserves query parameters that contain multiple values. (4.29.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.29.0)
- Transaction cookies now use FIFO eviction with a 3500-byte total size cap, preventing unbounded accumulation and 431 errors. (4.29.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.29.0)
- The state parameter is forwarded to the OIDC end-session URL during logout. (4.23.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.23.1)
- Interactive flow routing is corrected for mTLS. (4.23.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.23.1)
- Path-based issuer URLs no longer receive an added trailing slash. (4.23.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.23.0)
- MfaRequiredError is now surfaced from passkeyGetToken and passwordless verification flows. (4.23.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.23.0)
- Allows path-based domain URLs when using Okta custom authorization servers. (4.22.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.22.0)
- Domain validation now respects the allowInsecureRequests option. (4.20.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.20.0)
- Fixes MFA HTTP contract parity issues. (4.19.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.19.0)
- Skips MCD session backfill when running in static mode. (4.19.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.19.0)
- Fixed a race issue affecting DPoP nonce retries. (4.18.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.18.0)
- Construction is deferred when AUTH0_DOMAIN is not set at build time, preventing build-time failures. (4.17.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.17.1)
- Fixes a Next.js edge runtime build error involving the crypto module. (4.17.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.17.1)
- Prevents rolling sessions from re-creating a deleted session during concurrent logout. (4.17.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.17.0)
- Error details from HTTP 5xx OAuth responses are preserved. (4.16.2) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.16.2)
- Middleware no longer throws ERR_JWE_INVALID. (4.16.2) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.16.2)
- Made withPageAuthRequired generic to support PageProps and LayoutProps types. (4.16.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.16.1)
- Enabled full generic type inference so PageProps and LayoutProps propagate correctly. (4.16.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.16.1)
- Falsey values in authorization parameters are preserved instead of being stripped. (4.16.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.16.0)
- The SDK catches ERR_JWE_DECRYPTION_FAILED and ignores the cookie instead of throwing. (4.14.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.14.1)
- Using getAccessToken with refresh no longer causes a headers.append error in Next.js 16 proxy. (4.14.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.14.1)
- Fixed session writes for the Pages Router when using chunked cookies. (4.13.3) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.13.3)
- Updated the supported Next.js peer dependency versions. (4.13.2) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.13.2)
- Updated the supported React peer dependency versions. (4.13.2) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.13.2)
- Updated the supported React-DOM peer dependency versions. (4.13.2) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.13.2)
- Fixed broken Next.js 16 applications when basePath is used. (4.13.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.13.1)
- Adds support for Next 16. (4.13.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.13.0)
- Session changes are merged before finalizing the session after refresh. (4.13.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.13.0)
- TokenRequestCache is removed when calling getAccessToken. (4.12.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.12.1)
- The hook now receives the updated token after a token refresh. (4.11.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.11.1)
- Auth code callbacks now retry when a DPoP nonce is required. (4.11.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.11.1)
- Server helpers no longer depend on React, fixing bundling for edge runtimes. (4.11.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.11.1)
- Fixes updateSession behavior and related header overwrite issues. (4.11.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.11.1)
- with-next-intl now appends internationalization headers instead of overwriting existing headers. (4.11.1) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.11.1)
- The fetcher now honors token_type. (4.11.0) — [release notes](https://github.com/auth0/nextjs-auth0/releases/tag/v4.11.0)