Better Auth 1.7.15 Security Fixes, Wrangler 4.156.1

Executive Summary

• Better Auth 1.7.15 (Nov 1) is a bug-fix release with several security-relevant changes: a prototype pollution fix, no redirect following in social provider token exchange, trusted-origin validation on the Stripe success redirect, and banned-user enforcement in the admin plugin. See the release notes.
• Wrangler 4.156.1 (Nov 1) stops repeated slashes in URL paths from bypassing Pages Functions middleware, confines wrangler pages dev asset lookups to the output directory, and tightens OAuth callback checks. Details on the workers-sdk releases page.
• Next.js has announced a scheduled security release for Tuesday, November 3, 2026, covering seven medium-severity vulnerabilities. Per the advance notice, advisories and affected versions ship with the release. Latest stable on npm today is 16.4.3.
• Quiet on npm in the last 24 hours: Nuxt, Svelte, SvelteKit, Astro, NestJS, Fastify, Express, Elysia, MUI, Motion, Drizzle, Clerk and Supabase published no new stable versions. Prisma 8 stays at 8.0.0-rc.29 and Tailwind CSS at 4.3.3.

Better Auth 1.7.15

The release lists no new features, but the fixes matter if you run the organization, API key, admin, Stripe or social login plugins.

• Prototype pollution: organization and API key metadata, and OAuth proxy sign-ins, broke when additionalData contained a constructor field. Fixed.
• Redirects: built-in social providers no longer follow HTTP redirects during token exchange, refresh, verification and JWKS requests. The Stripe /subscription/success route now validates callbackURL against trusted origins after substituting the checkout session ID.
• Admin and sessions: banned users are now rejected when sessions are created outside an endpoint (for example via internalAdapter.createSession), and update-user returns 400 if data.id is supplied.
• Secrets: BETTER_AUTH_SECRETS errors now report the entry position instead of echoing its value, which keeps secrets out of logs.

Upgrade with your package manager:

npm install [email protected]

Cloudflare Wrangler 4.156.1

This patch (see the changelog) is worth taking for Pages users:

• Repeated slashes in URL paths (for example //admin) no longer bypass Pages Functions middleware. If you gate routes in middleware, upgrade.
• wrangler pages dev keeps asset lookups inside the configured output directory, so neighboring files sharing a name prefix are not served.
• OAuth login callbacks must match the pending login state, and provider error messages render as escaped text.
• Also: default compatibility date is now 2026-11-01, wrangler pages deploy honors the requested directory for Workers static-assets deploys, asset upload sessions retry transient server errors, and wrangler types --check handles CRLF files.

npm install -D [email protected]

Next.js: Plan for the November 3 Security Release

The Next.js team published an advance notice on October 27: seven medium-severity vulnerabilities will be fixed on November 3, with full advisories published alongside. Details are not public yet, so there is nothing to patch today. Use the window to confirm you can ship a version bump quickly: pin your current version (16.4.3 is the latest stable), make sure CI is green, and check which environments auto-deploy. Reports go through the Vercel bug bounty.

Still Relevant From Yesterday

Hono 4.13.16 (five advisories, see the release notes) remains the latest Hono release; if you have not upgraded yet, do so. Prisma 8 is still in release candidate (rc.29), so keep it out of production.

Coverage Note

Today's audit covered npm registry activity for the JavaScript stack plus official release pages. Container, database and infrastructure projects (Docker, Kubernetes, PostgreSQL, Redis, Keycloak and others) were not verified against their own release feeds today, so no claims are made about them.