fix(webauthn): upgrade to SimpleWebAuthn v13.3+/v14 without breaking stored credentials

[rvdlaar]

☕️ Reasoning

Moves WebAuthn/Passkey support from SimpleWebAuthn v9 to v13.3+ / v14. This clears two public SimpleWebAuthn advisories that Dependabot reports for every Auth.js app using passkeys:

• GHSA-6hxq-p678-4hr2: attestation x5c not chained to a trust anchor. Fixed in 13.3.2.
• GHSA-2g3p-m8c9-hhwh: CRL handling. Fixed in 14.0.2.

Both advisories are already published by SimpleWebAuthn, so nothing new is disclosed here. The PR builds on @rastislavcore's #13378, whose four commits are kept with their authorship, and completes it:

1. Stored credential IDs keep their format (bug fix vs Update/passkey 01 #13378). Auth.js stores credential IDs as standard base64 and normalises the browser's ID to that format before getAuthenticator(). SimpleWebAuthn v13+ uses base64url, and Update/passkey 01 #13378 stored credential.id as-is, so a passkey registered after the upgrade could never sign in. This PR keeps the stored format and converts only at the SimpleWebAuthn boundary. No adapter or data migration is needed.
2. next-auth and @auth/sveltekit get their peer ranges updated (Update/passkey 01 #13378 left them at ^9, which fails npm install with ERESOLVE) and their client helpers moved to the { optionsJSON } call form.
3. The default sign-in page script moves to v13.3.0, the docs cover v13.3+/v14, and the nextjs example uses ^14.0.2.

Review guide

• Core logic: packages/core/src/lib/utils/webauthn-utils.ts. Two small helpers (base64ToBase64URL, base64URLToBase64) are used at five call sites; the rest of the migration comes from Update/passkey 01 #13378.
• Clients: packages/next-auth/src/webauthn.ts and packages/frameworks-sveltekit/src/lib/webauthn.ts, a one-line change each.
• pnpm-lock.yaml: only SimpleWebAuthn's own dependency tree changes. @peculiar/* ASN.1/X.509 packages and tsyringe are added; asn1js, cross-fetch and @simplewebauthn/types are removed. Nothing else is re-resolved. The Socket report on this PR shows improved scores for both packages and no alerts.

Impact for users (release-note draft)

• Install @simplewebauthn/server@^14.0.2 and @simplewebauthn/browser@^14.0.0 (Node 22+). On Node 20, use @^13.3.2 / @^13.3.0. Both ranges are allowed.
• Existing Authenticator records keep working; no database change is needed.
• Custom provider options: nothing was removed from registrationOptions, authenticationOptions, verifyRegistrationOptions or verifyAuthenticationOptions. The one narrowing: attestationType no longer accepts "indirect" (SimpleWebAuthn v13.0.0 dropped it).
• Custom sign-in pages that call @simplewebauthn/browser directly should use startRegistration({ optionsJSON }) / startAuthentication({ optionsJSON }). The old positional form still works but logs a deprecation warning.

WebAuthn is behind experimental.enableWebAuthn, so I believe a fix: release is appropriate. I'm happy to change it to feat: if you prefer.

🧢 Checklist

• Documentation (JSDoc + docs pages)
• Tests
• Ready to be merged

Unit tests (@auth/core): 162/162. The fixture credential IDs were hex, which reads the same in base64 and base64url, and that is why #13378's encoding bug passed. They now contain +, / and =, the browser response uses base64url, and two tests cover the helpers. @auth/core, next-auth and @auth/sveltekit build (svelte-check reports 0 errors), and their tests pass. The devDependencies use v14, so the repo itself has no open advisory. The floor of the range (@simplewebauthn/server@13.3.3, @simplewebauthn/browser@13.3.0) also builds and passes the same tests. prettier --check and eslint report 0 errors on the changed files.

Real WebAuthn ceremonies (Chromium virtual authenticator, CTAP2 resident key) against a Next.js 16 app using next-auth@5 + Passkey + a custom adapter. Packed builds of this branch were compared with the released packages:

Scenario	Result
Released @auth/core 0.41.3 + SimpleWebAuthn 9: register → sign in (control)	6/6
This PR + SimpleWebAuthn 14: register → sign in	10/10
Upgrade: passkey registered on the released version, then sign in on this PR	4/4: same row, counter advances
#13378 as-is + SimpleWebAuthn 13.3: register → sign in	0/2: WebAuthn authenticator not found in database

Suggested squash commit message

fix(webauthn): support SimpleWebAuthn v13.3+ and v14

Upgrade the WebAuthn/Passkey providers from SimpleWebAuthn v9 to v13.3+/v14
(GHSA-6hxq-p678-4hr2, GHSA-2g3p-m8c9-hhwh). Stored credential IDs keep their
standard-base64 format and are converted to base64url only when talking to
SimpleWebAuthn, so existing Authenticator records need no migration.
next-auth and @auth/sveltekit peer ranges and client helpers are updated too.

Co-authored-by: Rastislav <rastislav@onion.email>

🎫 Affected issues

Supersedes #13378 (its commits are included). Happy to close this in favour of that PR if the author prefers to pick up these changes there.

📌 Resources

• Security guidelines
• Contributing guidelines
• SimpleWebAuthn v14.0.0 release notes (the only breaking change is the Node 22 minimum)

🤖 Generated with Claude Code

[vercel]

@rvdlaar is attempting to deploy a commit to the authjs Team on Vercel.

A member of the Team first needs to authorize it.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​simplewebauthn/​browser@​9.0.1 ⏵ 14.0.0	+1		+6	+6
	@​simplewebauthn/​server@​9.0.3 ⏵ 14.0.2		+1	+1	+1

View full report