unstale

npm / next-auth

next-auth

What changed in next-auth 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-27.

3 breaking2 security1 behavior and defaults1 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.8 on npm

next-auth 47 changes

Breaking changes 3

  • Returns null instead of throwing when the Authorization header contains a malformed Bearer value.

    4.24.15release notessecurity advisory

  • In trusted-host mode, an explicitly configured value takes precedence over the auto-detected forwarded host.

    4.24.15release notes

  • Check cookies are bound to the provider that created them and rejected when a different provider handles the callback; sign-ins in flight across the upgrade fail once and succeed on retry.

    4.24.15release notessecurity advisory

Security 2

  • Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

    4.24.15security advisory

  • Email addresses are Unicode-normalized (NFKC) before validation, closing a homoglyph @ bypass.

    4.24.15release notes

Behavior and default changes 1

  • The GitHub provider now defaults its issuer to https://github.com/login/oauth, preventing authentication failures when GitHub returns an iss parameter.

    4.24.14release notes

Fixes and other changes 1

  • Restores compatibility with require() on Node versions below 20.19 by pinning uuid to ^11.1.1.

    4.24.15release notes