Skip to content@clerk vulnerabilities
Newest
- @clerk nextjs, nuxt, shared +1 more +3 moreOfficial Clerk JavaScript SDKs: Middleware-based route protection bypassCVE-2026-41248Fix available9.1 Critical
- @clerk backendRemnawave Backend has a race condition in HWID device limit allows bypassing max devicesCVE-2026-398805.0 Medium
- @clerk expressSmoothwall Express < 3.1 Update 13 Reflected XSS in redirect.cgi via url ParameterCVE-2026-275085.1 Medium
- @clerk expressSmoothwall Express < 3.1 Update 13 Stored XSS in vpnmain.cgi via VPN_IP ParameterCVE-2026-263525.1 Medium
- @clerk fastifyFastify request.protocol and request.host spoofable via X-Forwarded-Proto/Host from untrusted connections when trustProxy uses restrictive trust functionCVE-2026-3635Fix available6.1 Medium
- @clerk fastifyFastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass ValidationCVE-2026-3419Fix available5.3 Medium
- @clerk fastifyFastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStreamCVE-2026-25224Fix available3.7 Low
- @clerk fastify, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +3 more +5 moreFastify's Content-Type header tab character allows body validation bypassCVE-2026-25223Fix available7.5 High
- @clerk nuxtNuxt Client-Side Path Traversal in Nuxt Island Payload RevivalCVE-2025-59414Fix available3.1 Low
- @clerk fastify, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +1 more +3 morefastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type HeaderCVE-2026-33806Fix available7.5 High
- @clerk fastifyFastify vulnerable to invalid content-type parsing, which could lead to validation bypassCVE-2025-32442Fix available7.5 High
- @clerk nuxtNuxt allows DOS via cache poisoning with payload rendering responseCVE-2025-27415Public exploitFix available7.5 High
- @clerk nuxtOpening a malicious website while running a Nuxt dev server could allow read-only access to codeCVE-2025-24361Fix available5.3 Medium
- @clerk nuxtOpening a malicious website while running a Nuxt dev server could allow read-only access to codeCVE-2025-24360Fix available5.3 Medium
- @clerk expressPreload arbitrary resources by injecting additional `Link` headersCVE-2024-10491Fix available4.0 Medium
- @clerk vueRegular Expression Denial of Service (ReDoS)CVE-2024-9506Public exploitFix available3.7 Low
- @clerk expressOpen RedirectCVE-2024-9266Fix available4.7 Medium
- @clerk expressexpress vulnerable to XSS via response.redirect()CVE-2024-43796Fix available5.0 Medium
- @clerk nuxtRemote code execution via the browser when running the test locally in nuxtCVE-2024-34344Fix available8.8 High
- @clerk nuxtCross-site Scripting (XSS) in navigateTo if used after SSR in nuxtCVE-2024-34343Fix available6.3 Medium
- @clerk nuxtPath Traversal: '../filedir' in Nuxt DevtoolsCVE-2024-23657Fix available8.8 High
- @clerk vueVue client-side XSS via prototype pollutionCVE-2024-6783Public exploitFix available4.8 Medium
- @clerk expressExpress.js Open Redirect in malformed URLsCVE-2024-29041Fix available6.1 Medium
- @clerk fastifyFastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content typeCVE-2022-41919Fix available4.2 Medium
- @clerk fastifyDenial of service in Fastify via Content-Type headerCVE-2022-39288Fix availableEPSS 59.2%7.5 High
- @clerk fastifyDenial of service in fastifyCVE-2020-8192Fix available6.5 Medium