Digest · Thursday
Security digest: July 23, 2026
3 critical advisories.
All digests · RSS · Markdown
Take stock
- npm: 2 critical advisories (
next-auth,@auth/core). Check withnpm audit (or: npm ls <package>). - Maven: 1 critical advisory (
com.alibaba:fastjson). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 3
GitHub-reviewed advisories rated critical, published this day (Pacific time).
npm 2
Check: npm audit (or: npm ls <package>)
- Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) CVE-2026-73421 CVSS 9.1 Critical
next-auth>= 5.0.0-beta.0, <= 5.0.0-beta.31 → fixed in 5.0.0-beta.32 - Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass CVE-2026-73420 CVSS 9.1 Critical
@auth/core>= 0.1.0, < 0.41.3 → fixed in 0.41.3;next-auth>= 4.10.3, < 4.24.15 → fixed in 4.24.15;next-auth>= 5.0.0-beta.1, <= 5.0.0-beta.31 → fixed in 5.0.0-beta.32
Maven 1
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- fastjson has a remote code execution (RCE) vulnerability CVE-2026-16723 CVSS 9.0 Critical
com.alibaba:fastjson>= 1.2.68, <= 1.2.83 → no fix listed