Clerk vulnerabilities

Products

• Javascript 4

Newest

• @clerk backend, nextjs, shared +31 more +33 more Clerk: Authorization bypass when combining organization, billing, or reverification checks CVE-2026-42349 Fix available 7.6 HighApril 30, 2026
• @clerk nextjs, nuxt, shared +1 more +3 more Official Clerk JavaScript SDKs: Middleware-based route protection bypass CVE-2026-41248 Fix available 9.1 CriticalApril 16, 2026
• clerk javascript Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host CVE-2026-34076 Fix available 7.4 HighMarch 27, 2026
• clerk javascript @clerk/backend Performs Insufficient Verification of Data Authenticity CVE-2025-53548 Fix available 7.5 HighJuly 9, 2025
• clerk javascript @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) CVE-2024-22206 Fix available 9.1 CriticalJanuary 12, 2024