Cannot find package 'jose' in Next.js App Router API Route on Vercel

[victorm]

I’m deploying a Next.js 15 App Router project to Vercel. My /app/api/auth/[…nextauth] API route uses NextAuth with the boxyhq-saml provider (which depends on jose). In production, during the OAuth callback, I get this error:

[next-auth][error][OAUTH_CALLBACK_ERROR] 
Cannot find package 'jose' imported from /var/task/.next/server/chunks/106.js

This only occurs in the deployed Vercel environment—not locally. All standard workarounds have failed.

What I’ve Tried

1. jose is a direct dependency:

• Present in dependencies in package.json

• Lockfile (package-lock.json) is committed and up to date

2. Verified jose is installed and works in other endpoints:

• Created a /api/test-jose endpoint that imports and uses jose—works fine in production.

3. Tried all import workarounds in […nextauth] route:

• Static import at the top of both /app/api/auth/[…nextauth].ts and /app/api/auth/[…nextauth]/route.ts

• Dynamic import (await import(‘jose’)) inside the handler function

• Created a shim file (_jose-shim.ts) that imports jose, and imported that at the top of route.ts

• Cleared .next, node_modules, lockfiles, and redeployed with Vercel cache cleared

4. Confirmed only one package.json and correct project root on Vercel

File Structure (relevant parts)

/app/api/auth/[...nextauth].ts

/app/api/auth/[...nextauth]/route.ts

/app/api/auth/_jose-shim.ts

/package.json

route.ts:

import '../_jose-shim';

import NextAuth from "next-auth";

import { authOptions } from "../[...nextauth]";

const handler = async (...args: any[]) => {

return NextAuth(authOptions)(...args);

};

export { handler as GET, handler as POST };

_jose-shim.ts:

import * as jose from 'jose';

export default jose;

The Error (full log)

[next-auth][error][OAUTH_CALLBACK_ERROR]

Cannot find package 'jose' imported from /var/task/.next/server/chunks/106.js

providerId: 'boxyhq-saml',

message: "Cannot find package 'jose' imported from /var/task/.next/server/chunks/106.js"

Additional Notes

-This only happens in the serverless function for /api/auth/[…nextauth]—other endpoints can import/use jose just fine.

• I have tried moving imports around, dynamic imports, and shim files.

• The error persists even after full clean builds and cache clears.

• I suspect this is a bug with the Next.js App Router and Vercel’s serverless bundling for peer/deep dependencies.

Any ideas or workarounds?

• Is there a known way to force inclusion of a dependency like jose in an App Router API route’s serverless bundle?

• Should I migrate my NextAuth route to /pages/api/auth/[…nextauth].ts as a workaround?

• Is there a fix or open issue I can track?

Thanks in advance!

[victorm]

Deployed on Render and everything works perfectly, so this is definitely a Vercel issue. Kindly asking that y’all fix this or provide a workaround, as I’d much prefer to stay on Vercel.

[amyegan]

Do you have a minimal reproducible example I can use to investigate this more? I haven’t been able to replicate it with my test project