The sign-in layer is this morning's headline. Auth.js — the library most Next.js apps use for authentication, including a large share of the LLM chat UIs and RAG frontends this audience runs — closes three advisories at once, two of them 9.1 criticals. Read the fail-open first: a configuration error makes the session object come back truthy instead of null, so an authorization check that should deny access ends up granting it to everyone (next-auth v5 betas, fixed in 5.0.0-beta.32). Alongside it, a passwordless sign-in link that can be steered to the wrong recipient via look-alike email addresses (9.1) and a malformed-Bearer-header crash (7.5), both reaching @auth/core and next-auth v4 and v5. If your frontend signs users in with Auth.js, that's today's upgrade — @auth/core 0.41.3, next-auth 4.24.15 or 5.0.0-beta.32.

Worth your morning

Auth.js — the fail-open critical. GHSA-8fpg-xm3f-6cx3 (9.1) affects the next-auth v5 betas: when a configuration error occurs, the returned auth object is truthy rather than null, so the common if (!session) …deny guard passes and the caller is treated as signed in. It's the access check that works right up until a config typo, then waves everyone through. Every v5 beta through 5.0.0-beta.31 is affected; 5.0.0-beta.32 restores the null. Many production Next.js apps pin to a v5 beta — if yours does, this is the version to move to first.

Auth.js — the sign-in link that lands with the wrong party. GHSA-7rqj-j65f-68wh (9.1) is in the email sign-in path: an address is validated before Unicode normalization, so a look-alike (homoglyph) address can clear validation and then normalize onto a real user's address — enough to redirect a passwordless magic link to the wrong recipient. It reaches @auth/core 0.1.0–0.41.2 and next-auth back to 4.10.3. Fixed in @auth/core 0.41.3 and next-auth 4.24.15 / 5.0.0-beta.32. If you offer email or magic-link sign-in, upgrade.

Auth.js — the crash. GHSA-xmf8-cvqr-rfgj (7.5) is the lightest of the three: an unauthenticated request carrying a malformed Bearer token throws an unhandled exception in getToken() and can take the auth handler down — a denial-of-service, not a bypass. Same fixed releases as above, and a wider next-auth range (back to 4.0.6), so fold it into the same bump.

Quiet elsewhere: the Next.js July release, JupyterLab, and n8n are in the last digest, and nothing new has cleared the bar on the .NET, NuGet, Azure, PrimeNG, or Angular side since July's servicing release on the 14th.