CVE detail
CVE-2026-73418
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent encoding causes decodeURIComponent() to throw instead of treating the token as invalid. Because getToken() is commonly called in API routes, middleware, and server-side request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests, causing a per-request denial of service without exposing tokens, sessions, or other data and without bypassing authentication. This issue is fixed in @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 20.8 · diversity 5.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 7
- within the 30d window
- Peak daily
- 7
- highest bucket
Evidence
Source links by recency
7 source links · newest first
No excerpt available.
Exploitgithub.comAug 12, 2026, 9:17 PMNo excerpt available.
Exploitgithub.comAug 12, 2026, 9:17 PMNo excerpt available.
Exploitgithub.comAug 12, 2026, 9:17 PMNo excerpt available.
Exploitgithub.comAug 12, 2026, 9:17 PMNo excerpt available.
Exploitgithub.comAug 12, 2026, 9:17 PMNo excerpt available.
Exploitgithub.comAug 12, 2026, 9:17 PMNo excerpt available.
Exploitgithub.comAug 12, 2026, 9:17 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-65834CVSS 6.8 · Medium
Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.N…
- CVE-2026-47219CVSS 7.5 · High
find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotel…
- CVE-2026-50328CVSS 7.5 · High
Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-14631CVSS 5.3 · Medium
webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a…
- CVE-2026-45685CVSS 7.5 · High
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed MongoDB wire messages c…
- CVE-2026-45676CVSS 5.5 · Medium
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI's replacement ELF parser trusts section offsets,…