I’m deploying a Next.js 15 App Router project to Vercel. My /app/api/auth/[...nextauth] API route uses NextAuth with the boxyhq-saml provider (which depends on jose). In production, during the OAuth callback, I get this error:
[next-auth][error][OAUTH_CALLBACK_ERROR] Cannot find package 'jose' imported from /var/task/.next/server/chunks/106.jsThis only occurs in the deployed Vercel environment—not locally. All standard workarounds have failed.
What I’ve Tried
- jose is a direct dependency:
-
Present in dependencies in package.json
-
Lockfile (package-lock.json) is committed and up to date
- Verified jose is installed and works in other endpoints:
- Created a /api/test-jose endpoint that imports and uses jose—works fine in production.
- Tried all import workarounds in [...nextauth] route:
-
Static import at the top of both /app/api/auth/[...nextauth].ts and /app/api/auth/[...nextauth]/route.ts
-
Dynamic import (await import('jose')) inside the handler function
-
Created a shim file (_jose-shim.ts) that imports jose, and imported that at the top of route.ts
-
Cleared .next, node_modules, lockfiles, and redeployed with Vercel cache cleared
- Confirmed only one package.json and correct project root on Vercel
File Structure (relevant parts)
/app/api/auth/[...nextauth].ts/app/api/auth/[...nextauth]/route.ts/app/api/auth/_jose-shim.ts/package.jsonroute.ts:
import '../_jose-shim';import NextAuth from "next-auth";import { authOptions } from "../[...nextauth]";const handler = async (...args: any[]) => {return NextAuth(authOptions)(...args);};export { handler as GET, handler as POST };_jose-shim.ts:
import * as jose from 'jose';export default jose;The Error (full log)
[next-auth][error][OAUTH_CALLBACK_ERROR]Cannot find package 'jose' imported from /var/task/.next/server/chunks/106.jsproviderId: 'boxyhq-saml',message: "Cannot find package 'jose' imported from /var/task/.next/server/chunks/106.js"Additional Notes
-This only happens in the serverless function for /api/auth/[...nextauth]—other endpoints can import/use jose just fine.
-
I have tried moving imports around, dynamic imports, and shim files.
-
The error persists even after full clean builds and cache clears.
-
I suspect this is a bug with the Next.js App Router and Vercel’s serverless bundling for peer/deep dependencies.
Any ideas or workarounds?
-
Is there a known way to force inclusion of a dependency like jose in an App Router API route’s serverless bundle?
-
Should I migrate my NextAuth route to /pages/api/auth/[...nextauth].ts as a workaround?
-
Is there a fix or open issue I can track?
Thanks in advance!