# What changed in next-auth

> 7 changes in next-auth 4 from its official release notes, upgrade guides and advisories: 3 breaking, 2 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/next-auth/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## next-auth 4

### Breaking changes

- Returns null instead of throwing when the Authorization header contains a malformed Bearer value. (4.24.15) — [release notes](https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15), [security advisory](https://github.com/advisories/GHSA-XMF8-CVQR-RFGJ)
- In trusted-host mode, an explicitly configured value takes precedence over the auto-detected forwarded host. (4.24.15) — [release notes](https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15)
- Check cookies are bound to the provider that created them and rejected when a different provider handles the callback; sign-ins in flight across the upgrade fail once and succeed on retry. (4.24.15) — [release notes](https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15), [security advisory](https://github.com/advisories/GHSA-X445-F3H2-J279)

### Security

- Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass (4.24.15) — [security advisory](https://github.com/advisories/GHSA-7RQJ-J65F-68WH)
- Email addresses are Unicode-normalized (NFKC) before validation, closing a homoglyph @ bypass. (4.24.15) — [release notes](https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15)

### Behavior and default changes

- The GitHub provider now defaults its issuer to https://github.com/login/oauth, preventing authentication failures when GitHub returns an iss parameter. (4.24.14) — [release notes](https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.14)

### Fixes and other changes

- Restores compatibility with require() on Node versions below 20.19 by pinning uuid to ^11.1.1. (4.24.15) — [release notes](https://github.com/nextauthjs/next-auth/releases/tag/next-auth%404.24.15)