CVE-2025-64762: @workos inc/authkit nextjs Authkit-nextjs May Let Session Cookies Vulnerability
HIGHCVE-2025-64762 is a HIGH authkit-nextjs may let session cookies vulnerability (CWE-524: Use of Cache Containing Sensitive Information) affecting @workos inc/authkit nextjs libraries in the npm ecosystem. The issue involves authkit-nextjs may let session cookies be cached in cdns. Remediation is available by upgrading affected packages to version 2.11.1.
CVE-2025-64762 at a Glance
How to Fix CVE-2025-64762
To remediate this vulnerability, upgrade all affected @workos inc/authkit nextjs dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @workos-inc/authkit-nextjs@2.11.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @workos-inc/authkit-nextjsHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2025-64762, inspect your project dependencies using npm:
npm ls @workos-inc/authkit-nextjsAnalyze the terminal output to locate any version of @workos inc/authkit nextjs in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.11.1), your application is affected.
Note: The npm ls @workos-inc/authkit-nextjs command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-524: Use of Cache Containing Sensitive Information, where the code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere. In @workos inc/authkit nextjs, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-64762 Affected @workos inc/authkit nextjs Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@workos-inc/authkit-nextjs
|
npm |
< 2.11.1
|
2.11.1
|
References
Frequently Asked Questions
What is CVE-2025-64762?
Which @workos inc/authkit nextjs versions are affected?
What version fixes CVE-2025-64762?
Is @workos-inc/authkit-nextjs affected?
What CWE is associated with CVE-2025-64762?
How can I check npm dependencies for CVE-2025-64762?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-p8pf-44ff-93gf",
"modified" : "2025-11-21T15:32:21Z",
"published" : "2025-11-20T21:29:16Z",
"aliases" : [ "CVE-2025-64762" ],
"summary" : "authkit-nextjs may let session cookies be cached in CDNs",
"details" : "In `authkit-nextjs` version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in session tokens being included in cached responses and subsequently served to multiple users.\n\nNext.js applications deployed on Vercel are unaffected **unless** they manually enable CDN caching by setting cache headers on authenticated paths.\n\n### Impact\nThis vulnerability may lead to session caching, potentially allowing unauthorized users to obtain another user’s session token. The severity depends on deployment configuration, caching policy, and whether authenticated routes are inadvertently cached.\n\n### Patches\nPatched in `authkit-nextjs` 2.11.1, which applies anti-caching headers to all responses behind authentication.\n\n### Notes\nAuthentication middleware should set anti-caching headers for authenticated routes as a defense in depth measure, but cannot guarantee these headers will not be overwritten elsewhere in the application. We recommend the following:\n - Review your application code, middleware, and infrastructure configuration to ensure the Cache-Control headers set for authenticated paths prevent inappropriate caching\n - For application paths that require caching, do not allow user-specific or sensitive authenticated information to be included in the response data or headers",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@workos-inc/authkit-nextjs"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.11.1"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 2.11.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/workos/authkit-nextjs/security/advisories/GHSA-p8pf-44ff-93gf"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-64762"
}, {
"type" : "WEB",
"url" : "https://github.com/workos/authkit-nextjs/commit/94cf438124993abb0e7c19dac64c3cb5724a15ea"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/workos/authkit-nextjs"
}, {
"type" : "WEB",
"url" : "https://github.com/workos/authkit-nextjs/releases/tag/v2.11.1"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-524" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-11-20T21:29:16Z",
"nvd_published_at" : "2025-11-21T02:15:44Z"
}
}