@clerk/clerk-js vulnerabilities (npm)

2 vulnerabilities.

• @clerk/clerk-js npm Clerk: Authorization bypass when combining organization, billing, or reverification checks CVE-2026-42349 Fix available 7.6 HighApril 30, 2026
• @clerk/clerk-js npm Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage CVE-2025-63700 Public exploitRejected 6.6 MediumNovember 20, 2025