Vulnerabilidades de Clerk
CVEs publicadas que afetam produtos de Clerk: 3 registro(s), com severidade, exploração e correções.
Javascript 2Clerk/shared 2Clerk/nuxt 2Clerk/nextjs 2Clerk/astro 2Clerk/hono 1Clerk/vue 1Clerk/tanstack-react-start 1Clerk/react-router 1Clerk/react 1Clerk/fastify 1Clerk/express 1Clerk/expo 1Clerk/clerk-react 1Clerk/clerk-js 1Clerk/clerk-expo 1Clerk/chrome-extension 1Clerk/backend 1
CVE-2026-42349
Alta · 8.1
CWE-754 11/05/2026
Clerk: Authorization bypass when combining organization, billing, or reverification checks
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
CVE-2026-41248
Crítica · 9.1
CWE-436 24/04/2026
SDKs JavaScript da Clerk: bypass de proteção de rotas por middleware
Clerk JavaScript é o repositório JavaScript oficial para a autenticação Clerk. createRouteMatcher em @clerk/nextjs, @clerk/nuxt e @clerk/astro pode ser contornado por determinadas requisições elaboradas, permitindo que ignorem o bloqueio de middleware e alcancem handlers posteriores. Esta vulnerabilidade está corrigida em @clerk/astro 1.5.7, 2.17.10 e 3.0.15; @clerk/nextjs 5.7.6, 6.39.2 e 7.2.1; @clerk/nuxt 1.13.28 e 2.2.2; e @clerk/shared 2.22.1, 3.47.4 e 4.8.1
CVE-2026-34076
Alta · 7.4
CWE-918 01/04/2026
Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5.