Headers.append: xxx is an invalid header value

[kennethaasan]

Checklist

• The issue can be reproduced in the nextjs-auth0 sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

Hi,

This is semi-related to #2219. In the latest version of Node.js, the nodejs runtime is now stable: https://nextjs.org/blog/next-15-5#nodejs-middleware-stable

I'm getting the same error as in #2219 when I enable this while following the middleware example in https://github.com/auth0/nextjs-auth0/blob/main/EXAMPLES.md#middleware-2 with the nodejs runtime enabled.

Reproduction

https://github.com/auth0/nextjs-auth0/blob/main/EXAMPLES.md#middleware-2

import { NextRequest, NextResponse } from "next/server";

import { auth0 } from "./lib/auth0"; // Adjust path if your auth0 client is elsewhere

export async function middleware(request: NextRequest) {
  const authRes = await auth0.middleware(request);

  if (request.nextUrl.pathname.startsWith("/auth")) {
    return authRes;
  }

  const session = await auth0.getSession(request);

  if (!session) {
    // user is not authenticated, redirect to login page
    return NextResponse.redirect(
      new URL("/auth/login", request.nextUrl.origin)
    );
  }

  const accessToken = await auth0.getAccessToken(request, authRes);

  // the headers from the auth middleware should always be returned
  return authRes;
}

export const config = {
  runtime: "nodejs",
  matcher: [
    /*
     * Match all request paths except for the ones starting with:
     * - _next/static (static files)
     * - _next/image (image optimization files)
     * - favicon.ico, sitemap.xml, robots.txt (metadata files)
     */
    "/((?!_next/static|_next/image|favicon.ico|sitemap.xml|robots.txt).*)",
  ],
};

Additional context

No response

nextjs-auth0 version

4.9.0

Next.js version

15.5.2

Node.js version

v22.14.0

[tusharpandey13]

Hi 👋

In the latest version of Node.js, the nodejs runtime is now stable: https://nextjs.org/blog/next-15-5#nodejs-middleware-stable

This happened in Next v15.5, nextjs-auth0 is currently using "next": "15.2.3",
While upgrading to the latest Next version is definitely a win for us considering any expected tradeoffs, we cannot comment on timelines yet on when this will be done. Since this is a minor version bump, we can release it with one of our upcoming releases.

Further, we will need some additional details like how you are calling updateSession or other methods that set response headers, since that seems to be going wrong here. Our middleware example is quite stable and expected to work out of the box.

[liukeyi300]

I meet same issue when I'm using auth0.getSession(req) in api route. but I think this may be caused by --turbopack
my env is:
nextjs-auth0 version: 4.10
nextjs version: 15.5.3
nodejs version: 24.8.0

after I removed the--turbopack in package.json, it works well.

[jgeurts]

@tusharpandey13

Seeing the same error message with Next.js 15.5.4, @auth0/nextjs-auth0 v4.10.0, and turbopack. Disabling turbopack fixes things.

Alternatively, disabling nodejs runtime for middleware also fixed it.

This is the specific error message:

web:dev:  ⨯ TypeError: Headers.append: "append(name, value) {
web:dev:         webidl.brandCheck(this, _Headers);
web:dev:         webidl.argumentLengthCheck(arguments, 2, "Headers.append");
web:dev:         const prefix = "Headers.append";
web:dev:         name = webidl.converters.ByteString(name, prefix, "name");
web:dev:         value = webidl.converters.ByteString(value, prefix, "value");
web:dev:         return appendHeader(this, name, value);
web:dev:       }" is an invalid header value.
web:dev:     at requireAuthMiddleware (src/lib/middleware/requireAuth.ts:59:33)
web:dev:     at dispatch (src/lib/middleware/compose.ts:21:32)
web:dev:     at <unknown> (src/lib/middleware/compose.ts:21:46)
web:dev:     at authenticateMiddleware (src/lib/middleware/authenticate.ts:41:12)
web:dev:     at dispatch (src/lib/middleware/compose.ts:21:32)
web:dev:     at executeMiddleware (src/lib/middleware/compose.ts:29:12)
web:dev:     at middleware (src/middleware.ts:13:10)
web:dev:   57 |     }
web:dev:   58 |
web:dev: > 59 |     const session = await auth0.getSession(request);