nextauthjs/next-auth · critical · ReferenceError

"next-auth/middleware" is deprecated. If you are not ready t

Error message

"next-auth/middleware" is deprecated. If you are not ready to migrate, keep using "next-auth@4".
Read more on https://authjs.dev/getting-started/migrating-to-v5

What it means

The next-auth/middleware module is a hard-deprecated re-export that immediately throws a ReferenceError at import time in next-auth v5 (Auth.js). The module was removed in the v5 migration; the throw exists purely to give a actionable message pointing to the migration guide, telling users to keep using next-auth@4 if they aren't ready to migrate.

Source

Thrown at packages/next-auth/src/middleware.ts:9

/**
 * :::warning Deprecated
 * This module is replaced in v5. Read more at: https://authjs.dev/getting-started/migrating-to-v5#authenticating-server-side
 * :::
 *
 * @module middleware
 */

throw new ReferenceError(
  [
    '"next-auth/middleware" is deprecated. If you are not ready to migrate, keep using "next-auth@4".',
    "Read more on https://authjs.dev/getting-started/migrating-to-v5",
  ].join("\n")
)

export {}

View on GitHub (pinned to a1a16a5a77)

Solutions

Remove the next-auth/middleware import and follow the v5 migration guide at authjs.dev/getting-started/migrating-to-v5.
Replace middleware-based auth with server-side checks: call auth() from next-auth inside your pages/route handlers (server components).
If you need edge middleware protection, export an auth config and wrap logic manually using the exported auth function suitable for edge runtime.
If not ready to migrate, pin next-auth@4 in package.json until the codebase is updated.

Example fix

// before
import { withAuth } from "next-auth/middleware"
export default withAuth({ pages: { signIn: "/login" } })
// after
import NextAuth from "next-auth"
export const { auth } = NextAuth({ ... })
// middleware.ts
export default auth((req) => {
  if (!req.auth) return Response.redirect(new URL("/login", req.url))
})

Defensive patterns

Strategy: fallback

Validate before calling

// Avoid at build time:
// import "next-auth/middleware" // <- throws ReferenceError in v5; do not import.

Try / catch

// Cannot be caught — throws at module load. Fix the import instead:
// Remove: import { withAuth } from "next-auth/middleware"
// Use: export default auth((req) => { /* check req.auth */ }) in middleware.ts

Prevention

After upgrading to next-auth v5, grep the codebase for 'next-auth/middleware' and remove it.
Read the v5 migration guide before upgrading: authjs.dev/getting-started/migrating-to-v5.
Replace middleware-based protection with server-side auth() checks or an edge-compatible auth wrapper.
Pin exact versions in package.json so major upgrades are intentional.

When it happens

Trigger: Importing "next-auth/middleware" (e.g. `import { withAuth } from "next-auth/middleware"` in middleware.ts) after upgrading to next-auth v5. The ReferenceError fires the moment the module is loaded, before any middleware code runs.

Common situations: Upgrading from next-auth@4 to v5 (Auth.js) without updating middleware.ts; following v4 tutorials while installing the latest package; copy-pasted middleware wrappers like withAuth/defaultMiddleware that no longer exist.

Related errors

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/62a5270e65af49e1. Report an issue: GitHub.