Skip to content
@clerk vulnerabilities
Newest
-
@clerk fastify
fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses
CVE-2026-120216
5.9 Medium
-
@clerk nuxt
Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam
CVE-2026-120309
6.3 Medium
-
@clerk nuxt
Nuxt dev server exposes generated appSecret through Vite file serving
CVE-2026-119201
Fix available
4.8 Medium
-
@clerk nuxt, @nuxt nitro-server +1 more
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
CVE-2026-119200
Fix available
6.5 Medium
-
@clerk nuxt
Nuxt dev server exposes private runtime config through the Nitro dev bundle
CVE-2026-119199
Fix available
5.9 Medium
-
@clerk nuxt
Nuxt dev server arbitrary file read through client error reports
CVE-2026-119198
Fix available
5.9 Medium
-
@clerk nuxt
Nuxt server islands render `useHeadSafe` input without sanitisation
CVE-2026-114133
Fix available
5.4 Medium
-
@clerk nuxt
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
CVE-2026-114132
Fix available
6.3 Medium
-
@clerk nuxt
Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
CVE-2026-114131
Fix available
6.5 Medium
-
@clerk nuxt
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
CVE-2026-114130
Fix available
2.3 Low
-
@clerk fastify
fastify vulnerable to header validation bypass via case-sensitive propertyNames
CVE-2026-107832
Fix available
3.7 Low
-
@clerk express, ubiquiti inc cloud gateways, dream machines +5 more +7 more
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability...
CVE-2026-95862
7.5 High
-
@clerk express, ubiquiti inc cloud gateways, dream machines +5 more +7 more
A malicious actor with access to the network could exploit an Uncontrolled Recursion...
CVE-2026-95861
7.5 High
-
@clerk express, ubiquiti inc cloud gateways, dream machines +5 more +7 more
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability...
CVE-2026-77558
7.5 High
-
@clerk express, ubiquiti inc cloud gateways, dream machines +5 more +7 more
A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability...
CVE-2026-77556
7.5 High
-
@clerk express, ubiquiti inc cloud gateways, dream machines +5 more +7 more
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability...
CVE-2026-77555
7.5 High
-
@clerk express, ubiquiti inc cloud gateways, dream machines +5 more +7 more
A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability...
CVE-2026-77544
7.5 High
-
@clerk fastify
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
CVE-2026-92081
Fix available
5.9 Medium
-
@clerk fastify
fastify vulnerable to header validation bypass via incomplete schema case normalization
CVE-2026-84428
Fix available
7.5 High
-
@clerk fastify
fastify vulnerable to request validation bypass via skipped boolean false schemas
CVE-2026-84469
Fix available
7.5 High
-
@clerk fastify
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
CVE-2026-76169
Fix available
7.5 High
-
@clerk fastify
fastify vulnerable to request body replacement via an async validation result collision
CVE-2026-84504
Fix available
8.1 High
-
@clerk express, ubiquiti inc cloud gateways, cloud keys +11 more +13 more
A malicious actor with access to the network could exploit an Improper Neutralization of CRLF...
CVE-2026-77550
10.0 Critical
-
@clerk express, ubiquiti inc cloud gateways, cloud keys +11 more +13 more
A malicious actor with access to the network and under certain conditions could exploit an...
CVE-2026-77549
9.0 Critical
-
@clerk fastify
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
CVE-2026-16732
Fix available
6.1 Medium
-
@clerk fastify
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
CVE-2026-18504
Public exploitFix available
5.4 Medium
-
@clerk nuxt
Nuxt before 4.5.1 Information Disclosure via Chrome DevTools
CVE-2026-72744
Public exploitFix available
6.9 Medium
-
@clerk nuxt
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
CVE-2026-71321
Fix available
7.5 High
-
@clerk nuxt
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
CVE-2026-71320
Fix available
8.1 High
-
@clerk nuxt
Nuxt: Unauthorized Component Instantiation via Server Island Props
CVE-2026-71318
Fix available
4.8 Medium
-
@clerk nuxt
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
CVE-2026-71316
Fix available
7.5 High
-
@clerk nuxt
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
CVE-2026-71315
Fix available
8.2 High
-
@clerk nuxt
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
CVE-2026-71314
Fix available
7.5 High
-
@clerk nuxt
Nuxt - Cross-Site Scripting via NoScript Component Slot Content
CVE-2026-56317
Fix available
2.3 Low
-
@clerk nuxt
Nuxt - Cross-Site Scripting via navigateTo open Option
CVE-2026-56698
Fix available
5.3 Medium
-
@clerk nuxt
Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp
CVE-2026-56697
Fix available
5.3 Medium
-
@clerk nuxt
Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo
CVE-2026-56326
Fix available
5.3 Medium
-
@clerk nuxt
Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux
CVE-2026-56301
Fix available
6.8 Medium
-
@clerk nuxt
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
CVE-2026-53722
Fix available
5.1 Medium
-
@clerk nuxt
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
CVE-2026-53721
Fix available
8.8 High
-
@clerk nuxt, nuxt nuxt\/rspack-builder, nuxt\/webpack-builder +2 more
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
CVE-2026-49993
Fix available
5.9 Medium
-
@clerk express, free5gc udm, udr +29 more +31 more
A malicious actor with access to the network and low privileges could exploit an Improper Input...
CVE-2026-47370
9.9 Critical
-
@clerk express, free5gc udm, udr +29 more +31 more
A malicious actor with access to the network and low privileges could exploit an Improper Input...
CVE-2026-47369
9.9 Critical
-
@clerk express, free5gc udm, udr +29 more +31 more
A malicious actor with access to the network could exploit a Path Traversal vulnerability found...
CVE-2026-47368
8.6 High
-
@clerk nuxt, nuxt nuxt\/nitro-server +1 more
Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`
CVE-2026-47200
Fix available
6.3 Medium
-
ubiquiti unifi os, @clerk express, free5gc udm +61 more +63 more
A malicious actor with access to the network could exploit a Path Traversal vulnerability found...
CVE-2026-34909
In KEV
EPSS 68.0%
10.0 Critical
-
@clerk nuxt, nuxt nuxt\/nitro-server +1 more
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
CVE-2026-46342
Fix available
2.3 Low
-
@clerk nuxt, nuxt nuxt\/rspack-builder, nuxt\/webpack-builder +2 more
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
CVE-2026-45670
Fix available
5.9 Medium
-
@clerk nuxt
Nuxt: Reflected XSS in `navigateTo()` external redirect
CVE-2026-45669
Fix available
5.3 Medium
-
@clerk backend, nextjs, shared +31 more +33 more
Clerk: Authorization bypass when combining organization, billing, or reverification checks
CVE-2026-42349
Fix available
7.6 High
- Show olderLoading…