Auth.js (NextAuth.js)

Auth.js (NextAuth.js): frequently asked questions

Has next-auth v5 reached stable?

No, and this is the single most common misconception about the project. As of September 2026 the npm latest tag for next-auth is 4.24.15, while v5 sits on the beta tag at 5.0.0-beta.32. The official migration guide still instructs you to install next-auth@beta. The underlying @auth/core package is at 0.41.3, still pre-1.0. The v5 rewrite has been in public beta since 2022 and has never shipped a stable release. Many teams run the beta in production anyway, which matters because the critical fail-open vulnerability disclosed in July 2026 affected only the v5 beta line.

Who maintains Auth.js now?

The Better Auth team, which is itself owned by Vercel. On 22 September 2025 Auth.js and NextAuth.js maintenance transferred to Better Auth, confirmed by a banner on the Auth.js homepage stating the project is now part of Better Auth. Vercel then acquired Better Auth on 7 July 2026. The maintaining team's own public position is that new projects should start with Better Auth unless there are specific feature gaps, while existing Auth.js users can continue without disruption and will keep receiving security patches and urgent fixes. Treat Auth.js as being in security maintenance rather than active feature development. The repository's last push at time of review was 22 July 2026.

What license is Auth.js and who funds it?

ISC, not MIT, which several secondary write-ups get wrong. Funding is donation-based through Open Collective, which shows 58,623 dollars raised lifetime, a current balance of about 1,033 dollars and an estimated annual budget of 4,400 dollars across 55 contributors. The notable sponsors are direct commercial competitors: Auth0 at 15,000 dollars, FusionAuth at 8,000, WorkOS at 4,400 and Vercel at 3,600. There is no company selling Auth.js, no paid tier and no hosted service.

What can Auth.js actually do?

More than 80 preconfigured OAuth providers, 24 database adapters in-repo covering Prisma, Drizzle, MongoDB, PostgreSQL, DynamoDB, Supabase and others, and four non-Next framework integrations for Express, Qwik, SolidStart and SvelteKit. Authentication methods are OAuth, magic links, credentials and WebAuthn. Session strategy can be stateless JWT or database-backed. What it does not have, based on the absence of any documentation for them: no first-party MFA or TOTP, no organizations or multi-tenancy, no SAML, no SCIM, no first-party RBAC. All 80-plus providers are OAuth and OIDC.

Does Auth.js support passkeys?

Only experimentally, and only in the beta line. The documentation states plainly that the WebAuthn and passkeys provider is experimental and not recommended for production use. It requires next-auth 5.0.0-beta.8 or later plus @auth/prisma-adapter 1.3.0 or later and Node 20 or later, which means there is no passkey support at all in the stable v4 release. If passkeys are a requirement, this is the clearest reason to look at Better Auth instead, where the passkey plugin is not flagged experimental.

What security vulnerabilities has Auth.js had?

Fourteen advisories in total, with a significant batch published on 23 July 2026, all fixed in next-auth 4.24.15, 5.0.0-beta.32 and @auth/core 0.41.3. Two were critical at CVSS 9.1: CVE-2026-73421, where configuration errors could make existence-based authentication checks fail open, affecting only v5 beta releases, and CVE-2026-73420, where the email normaliser validated before Unicode normalisation allowing a homoglyph bypass of the at sign. Also in that batch were CVE-2026-73418 (7.5, uncaught exception on malformed Bearer headers) and CVE-2026-73419 (6.8, OAuth state, nonce and PKCE cookies not bound to the issuing provider). Earlier history includes CVE-2022-35924 at 9.1 and CVE-2023-27490 at 8.1. No Auth.js entry appears in the CISA KEV catalog.

Is Auth.js suitable for enterprise use?

It is a library, not a service, and that distinction decides it. There is no SLA, no support contract, and no published compliance certification such as SOC 2 or ISO 27001. Maintenance funding is roughly 4,400 dollars a year in donations, and human contribution has historically been concentrated in three or four people who have now handed the project over. For a side project or an application where you own the authentication risk, that can be fine. For a regulated enterprise deployment that needs SAML, SCIM, an audit trail and someone to call, Auth0, WorkOS, Clerk or Okta are the honest comparison.

Should I migrate from Auth.js to Better Auth?

For new projects, the maintainers themselves say yes. Better Auth ships stable 1.x releases weekly, has 6.09 million weekly npm downloads against next-auth's 4.41 million as of mid-September 2026, and covers the enterprise gaps Auth.js does not: 2FA and TOTP, non-experimental passkeys, organizations and multi-tenancy, SAML 2.0 through its SSO plugin, and inbound SCIM 2.0. For an existing Auth.js application that works and needs none of those, there is no urgency: security patches continue. An official migration guide exists at authjs.dev.