5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40155

CVE-2026-40155: Auth0 Next.js SDK has Improper Proxy Cache Lookup

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40155

CVE-2026-40155:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@auth0/nextjs-auth0	npm	>= 4.12.0, <= 4.17.0	4.18.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a race condition caused by an improper caching strategy for Fetcher objects within the Auth0 Next.js SDK's proxy handlers. When DPoP is enabled, these handlers are used to make authenticated API requests. The root cause was that the entire Fetcher object, which contains request-specific state like DPoP nonces and access token closures, was being cached and shared across concurrent requests for the same resource audience.

The vulnerable function AuthClientProvider.getProxyFetcher and the corresponding logic within AuthClient.proxy would return a cached Fetcher instance. If two users made requests to a proxied endpoint at the same time, they could end up sharing the same Fetcher instance. If one of those requests triggered a DPoP nonce retry, the state of that Fetcher would be modified. The second request, using this same modified Fetcher, would then proceed with incorrect state, leading to potential session corruption or one user's request being processed with another user's authorization context.

The patch resolves this by changing the caching strategy. Instead of caching the entire Fetcher, only the DPoPHandle (which manages nonce state) is cached per audience. The AuthClient.proxy method was refactored to create a new, request-specific Fetcher for every call, which is then initialized with the shared DPoPHandle. This ensures that while the DPoP nonce state is correctly maintained across retries for a given context, the request-specific state is isolated, thus eliminating the race condition.

Vulnerable functions

AuthClientProvider.getProxyFetcher

src/server/auth-client-provider.ts

This function was responsible for caching and reusing 'Fetcher' objects. This was the core of the vulnerability, as it allowed request-specific state to be shared across concurrent requests, leading to a race condition. In a high-concurrency scenario, a request could receive a cached fetcher that was already in use by another request, particularly during a DPoP nonce retry, causing improper state handling and potential session mix-ups.

AuthClient.proxy

src/server/auth-client.ts

The `proxy` method in `AuthClient` was vulnerable because it utilized the flawed caching mechanism (either from `AuthClientProvider.getProxyFetcher` or a local cache) to retrieve and reuse `Fetcher` objects. This reuse across different requests is what created the race condition. A fetcher's state, including its `getAccessToken` closure which is tied to a specific user session, could be used in the context of another user's request, leading to incorrect authorization and session data corruption.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.