Read the docs
TI-2026-26399 Aliases CVE-2026-34076GHSA-gjxx-92w9-8v8f

Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

Priority LOW 34CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00321 25th percentileScored 2026-11-07
Fix Fixed @clerk/backend (npm): 3.2.3@clerk/express (npm): 2.0.7+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
clerkjavascript@clerk/hono >= 0.1.0, < 0.1.5; @clerk/express >= 2.0.0, < 2.0.7; @clerk/backend >= 3.0.0, < 3.2.3; @clerk/fastify >= 3.1.0, < 3.1.5—No fix listedCNA
—@clerk/backend (npm)3.0.0 to before 3.2.33.2.3Patch availableGHSA-gjxx-92w9-8v8f
—@clerk/express (npm)2.0.0 to before 2.0.72.0.7Patch availableGHSA-gjxx-92w9-8v8f
—@clerk/hono (npm)0.1.0 to before 0.1.50.1.5Patch availableGHSA-gjxx-92w9-8v8f
—@clerk/fastify (npm)3.1.0 to before 3.1.53.1.5Patch availableGHSA-gjxx-92w9-8v8f
  • javascript Vendorclerk Affected @clerk/hono >= 0.1.0, < 0.1.5; @clerk/express >= 2.0.0, < 2.0.7; @clerk/backend >= 3.0.0, < 3.2.3; @clerk/fastify >= 3.1.0, < 3.1.5 Fixed in — No fix listed CNA
  • @clerk/backend (npm) Vendor— Affected 3.0.0 to before 3.2.3 Fixed in 3.2.3 Patch available GHSA-gjxx-92w9-8v8f
  • @clerk/express (npm) Vendor— Affected 2.0.0 to before 2.0.7 Fixed in 2.0.7 Patch available GHSA-gjxx-92w9-8v8f
  • @clerk/hono (npm) Vendor— Affected 0.1.0 to before 0.1.5 Fixed in 0.1.5 Patch available GHSA-gjxx-92w9-8v8f
  • @clerk/fastify (npm) Vendor— Affected 3.1.0 to before 3.1.5 Fixed in 3.1.5 Patch available GHSA-gjxx-92w9-8v8f

Remediation

  • Fix · GHSA-gjxx-92w9-8v8f @clerk/backend (npm) Fixed in 3.2.3 Advisory →
  • Fix · GHSA-gjxx-92w9-8v8f @clerk/express (npm) Fixed in 2.0.7 Advisory →
  • Fix · GHSA-gjxx-92w9-8v8f @clerk/hono (npm) Fixed in 0.1.5 Advisory →
  • Fix · GHSA-gjxx-92w9-8v8f @clerk/fastify (npm) Fixed in 3.1.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34076
  2. 2026-10-03 Alias added: GHSA-gjxx-92w9-8v8f

References

Advisory 1

Other 2

  • TI-2026-30651 Clerk: Authorization bypass when combining organization, billing, or reverification checks CVSS 4.0HIGH 7.6
  • TI-2024-14799 @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) CVSS 3.1CRITICAL 9.8
  • TI-2026-29857 Official Clerk JavaScript SDKs: Middleware-based route protection bypass CVSS 3.1CRITICAL 9.1
  • TI-2025-33492 @clerk/backend Performs Insufficient Verification of Data Authenticity CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences