GHSA-xmf8-cvqr-rfgj: Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

Summary The exported getToken() helper (next-auth/jwt and @auth/core/jwt) can throw an uncaught exception when it reads a malformed Authorization: Bearer … header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed percent-encoding causes the decode step to throw rather than being treated as an invalid token. Because getToken() is commonly called in API routes, middleware, and other request handlers, a single unauthenticated request can trigger an unhandled exception in code paths that authenticate requests. Am I affected? You are affected if all of the following hold: - You use next-auth <= 5.0.0-beta.25 (or @auth/core exposing the same getToken() implementation). - Your application calls getToken() directly — for example in a Route Handler, middleware, or server-side request handler. - You do not wrap that getToken() call in your own try/catch. You are not affected if you only use the framework's auth() helper and never call getToken() yourself, or if every getToken() call site already has its own exception handling. Impact - Denial of service: an unauthenticated request carrying a malformed Bearer authorization header can raise an unhandled exception in any handler that calls getToken(). - The impact is per-request and limited to availability; it does not expose tokens, sessions, or other data, and does not bypass authentication. CWE-20: Improper Input Validation. Patched version The fix makes getToken() treat a malformed Bearer value as an invalid token and return null, matching how other undecodable tokens are already handled. Upgrade to the first release containing this fix (to be published; this advisory will be updated with the exact patched version before publication) and no code changes are required. Workarounds If you cannot upgrade immediately, either: - Config/code-level: wrap your getToken() calls so a thrown error is treated as "no token", e.g. let token = null try { token = awa