Clerk: Authorization bypass when combining organization, billing, or reverification checks
Priority HIGH 66CWE-754Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00246 15th percentileScored 2026-11-07
Fix Fixed javascript (clerk): 5.125.10, 6.7.5@clerk/shared (npm): 3.47.5, 4.8.3+16 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| clerk | javascript | 5.22.0 to before 5.125.10; 6.0.0 to before 6.7.5 | 5.125.10, 6.7.5 | Patch available | CNA |
| clerk | shared | 3.0.0 – 3.47.4; 4.0.0 – 4.8.2 | — | No fix listed | CNA |
| clerk | backend | 2.0.0 – 2.33.2; 3.0.0 – 3.2.13 | — | No fix listed | CNA |
| clerk | nextjs | 6.0.0 – 6.39.2; 7.0.0 – 7.2.3 | — | No fix listed | CNA |
| clerk | clerk-react | 5.9.0 – 5.61.5 | — | No fix listed | CNA |
| clerk | react | 6.0.0 – 6.4.2 | — | No fix listed | CNA |
| clerk | vue | 1.0.0 – 1.17.20; 2.0.0 – 2.0.15 | — | No fix listed | CNA |
| clerk | astro | 2.0.0 – 2.17.10; 3.0.0 – 3.0.17 | — | No fix listed | CNA |
| clerk | nuxt | 1.0.0 – 1.13.28; 2.0.0 – 2.2.4 | — | No fix listed | CNA |
| clerk | clerk-expo | 2.2.11 – 2.19.35 | — | No fix listed | CNA |
| clerk | expo | 3.0.0 – 3.2.1 | — | No fix listed | CNA |
| clerk | react-router | 0.0.1 – 2.4.12; 3.0.0 – 3.1.3 | — | No fix listed | CNA |
| clerk | tanstack-react-start | 0.0.1 – 0.29.10; 1.0.0 – 1.1.3 | — | No fix listed | CNA |
| clerk | chrome-extension | 1.3.5 – 2.9.14; 3.0.0 – 3.1.14 | — | No fix listed | CNA |
| clerk | fastify | 1.0.42 – 2.6.30; 3.0.0 – 3.1.15 | — | No fix listed | CNA |
| clerk | express | 0.1.0 – 1.7.78; 2.0.0 – 2.1.5 | — | No fix listed | CNA |
| clerk | hono | 0.0.2 – 0.1.15 | — | No fix listed | CNA |
| — | @clerk/shared (npm) | 3.0.0 to before 3.47.5 | 3.47.5 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/shared (npm) | 4.0.0 to before 4.8.3 | 4.8.3 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/backend (npm) | 2.0.0 to before 2.33.3 | 2.33.3 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/backend (npm) | 3.0.0 to before 3.2.14 | 3.2.14 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/nextjs (npm) | 6.0.0 to before 6.39.3 | 6.39.3 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/nextjs (npm) | 7.0.0 to before 7.2.4 | 7.2.4 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/clerk-js (npm) | 5.22.0 to before 5.125.10 | 5.125.10 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/clerk-js (npm) | 6.0.0 to before 6.7.5 | 6.7.5 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/clerk-react (npm) | 5.9.0 to before 5.61.6 | 5.61.6 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/react (npm) | 6.0.0 to before 6.4.3 | 6.4.3 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/vue (npm) | 1.0.0 to before 1.17.21 | 1.17.21 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/vue (npm) | 2.0.0 to before 2.0.16 | 2.0.16 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/astro (npm) | 2.0.0 to before 2.17.11 | 2.17.11 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/astro (npm) | 3.0.0 to before 3.0.18 | 3.0.18 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/nuxt (npm) | 1.0.0 to before 1.13.29 | 1.13.29 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/nuxt (npm) | 2.0.0 to before 2.2.5 | 2.2.5 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/clerk-expo (npm) | 2.2.11 to before 2.19.36 | 2.19.36 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/expo (npm) | 3.0.0 to before 3.2.2 | 3.2.2 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/react-router (npm) | 0.0.1 to before 2.4.13 | 2.4.13 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/react-router (npm) | 3.0.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/tanstack-react-start (npm) | 0.0.1 to before 0.29.11 | 0.29.11 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/tanstack-react-start (npm) | 1.0.0 to before 1.1.4 | 1.1.4 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/chrome-extension (npm) | 1.3.5 to before 2.9.15 | 2.9.15 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/chrome-extension (npm) | 3.0.0 to before 3.1.15 | 3.1.15 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/fastify (npm) | 1.0.42 to before 2.6.31 | 2.6.31 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/fastify (npm) | 3.0.0 to before 3.1.16 | 3.1.16 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/express (npm) | 0.1.0 to before 1.7.79 | 1.7.79 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/express (npm) | 2.0.0 to before 2.1.6 | 2.1.6 | Patch available | GHSA-w24r-5266-9c3c |
| — | @clerk/hono (npm) | 0.0.2 to before 0.1.16 | 0.1.16 | Patch available | GHSA-w24r-5266-9c3c |
- javascript Vendorclerk Affected 5.22.0 to before 5.125.10; 6.0.0 to before 6.7.5 Fixed in 5.125.10, 6.7.5 Patch available CNA
- shared Vendorclerk Affected 3.0.0 – 3.47.4; 4.0.0 – 4.8.2 Fixed in — No fix listed CNA
- backend Vendorclerk Affected 2.0.0 – 2.33.2; 3.0.0 – 3.2.13 Fixed in — No fix listed CNA
- nextjs Vendorclerk Affected 6.0.0 – 6.39.2; 7.0.0 – 7.2.3 Fixed in — No fix listed CNA
- clerk-react Vendorclerk Affected 5.9.0 – 5.61.5 Fixed in — No fix listed CNA
- react Vendorclerk Affected 6.0.0 – 6.4.2 Fixed in — No fix listed CNA
- vue Vendorclerk Affected 1.0.0 – 1.17.20; 2.0.0 – 2.0.15 Fixed in — No fix listed CNA
- astro Vendorclerk Affected 2.0.0 – 2.17.10; 3.0.0 – 3.0.17 Fixed in — No fix listed CNA
- nuxt Vendorclerk Affected 1.0.0 – 1.13.28; 2.0.0 – 2.2.4 Fixed in — No fix listed CNA
- clerk-expo Vendorclerk Affected 2.2.11 – 2.19.35 Fixed in — No fix listed CNA
- expo Vendorclerk Affected 3.0.0 – 3.2.1 Fixed in — No fix listed CNA
- react-router Vendorclerk Affected 0.0.1 – 2.4.12; 3.0.0 – 3.1.3 Fixed in — No fix listed CNA
- tanstack-react-start Vendorclerk Affected 0.0.1 – 0.29.10; 1.0.0 – 1.1.3 Fixed in — No fix listed CNA
- chrome-extension Vendorclerk Affected 1.3.5 – 2.9.14; 3.0.0 – 3.1.14 Fixed in — No fix listed CNA
- fastify Vendorclerk Affected 1.0.42 – 2.6.30; 3.0.0 – 3.1.15 Fixed in — No fix listed CNA
- express Vendorclerk Affected 0.1.0 – 1.7.78; 2.0.0 – 2.1.5 Fixed in — No fix listed CNA
- hono Vendorclerk Affected 0.0.2 – 0.1.15 Fixed in — No fix listed CNA
- @clerk/shared (npm) Vendor— Affected 3.0.0 to before 3.47.5 Fixed in 3.47.5 Patch available GHSA-w24r-5266-9c3c
- @clerk/shared (npm) Vendor— Affected 4.0.0 to before 4.8.3 Fixed in 4.8.3 Patch available GHSA-w24r-5266-9c3c
- @clerk/backend (npm) Vendor— Affected 2.0.0 to before 2.33.3 Fixed in 2.33.3 Patch available GHSA-w24r-5266-9c3c
- @clerk/backend (npm) Vendor— Affected 3.0.0 to before 3.2.14 Fixed in 3.2.14 Patch available GHSA-w24r-5266-9c3c
- @clerk/nextjs (npm) Vendor— Affected 6.0.0 to before 6.39.3 Fixed in 6.39.3 Patch available GHSA-w24r-5266-9c3c
- @clerk/nextjs (npm) Vendor— Affected 7.0.0 to before 7.2.4 Fixed in 7.2.4 Patch available GHSA-w24r-5266-9c3c
- @clerk/clerk-js (npm) Vendor— Affected 5.22.0 to before 5.125.10 Fixed in 5.125.10 Patch available GHSA-w24r-5266-9c3c
- @clerk/clerk-js (npm) Vendor— Affected 6.0.0 to before 6.7.5 Fixed in 6.7.5 Patch available GHSA-w24r-5266-9c3c
- @clerk/clerk-react (npm) Vendor— Affected 5.9.0 to before 5.61.6 Fixed in 5.61.6 Patch available GHSA-w24r-5266-9c3c
- @clerk/react (npm) Vendor— Affected 6.0.0 to before 6.4.3 Fixed in 6.4.3 Patch available GHSA-w24r-5266-9c3c
- @clerk/vue (npm) Vendor— Affected 1.0.0 to before 1.17.21 Fixed in 1.17.21 Patch available GHSA-w24r-5266-9c3c
- @clerk/vue (npm) Vendor— Affected 2.0.0 to before 2.0.16 Fixed in 2.0.16 Patch available GHSA-w24r-5266-9c3c
- @clerk/astro (npm) Vendor— Affected 2.0.0 to before 2.17.11 Fixed in 2.17.11 Patch available GHSA-w24r-5266-9c3c
- @clerk/astro (npm) Vendor— Affected 3.0.0 to before 3.0.18 Fixed in 3.0.18 Patch available GHSA-w24r-5266-9c3c
- @clerk/nuxt (npm) Vendor— Affected 1.0.0 to before 1.13.29 Fixed in 1.13.29 Patch available GHSA-w24r-5266-9c3c
- @clerk/nuxt (npm) Vendor— Affected 2.0.0 to before 2.2.5 Fixed in 2.2.5 Patch available GHSA-w24r-5266-9c3c
- @clerk/clerk-expo (npm) Vendor— Affected 2.2.11 to before 2.19.36 Fixed in 2.19.36 Patch available GHSA-w24r-5266-9c3c
- @clerk/expo (npm) Vendor— Affected 3.0.0 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-w24r-5266-9c3c
- @clerk/react-router (npm) Vendor— Affected 0.0.1 to before 2.4.13 Fixed in 2.4.13 Patch available GHSA-w24r-5266-9c3c
- @clerk/react-router (npm) Vendor— Affected 3.0.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-w24r-5266-9c3c
- @clerk/tanstack-react-start (npm) Vendor— Affected 0.0.1 to before 0.29.11 Fixed in 0.29.11 Patch available GHSA-w24r-5266-9c3c
- @clerk/tanstack-react-start (npm) Vendor— Affected 1.0.0 to before 1.1.4 Fixed in 1.1.4 Patch available GHSA-w24r-5266-9c3c
- @clerk/chrome-extension (npm) Vendor— Affected 1.3.5 to before 2.9.15 Fixed in 2.9.15 Patch available GHSA-w24r-5266-9c3c
- @clerk/chrome-extension (npm) Vendor— Affected 3.0.0 to before 3.1.15 Fixed in 3.1.15 Patch available GHSA-w24r-5266-9c3c
- @clerk/fastify (npm) Vendor— Affected 1.0.42 to before 2.6.31 Fixed in 2.6.31 Patch available GHSA-w24r-5266-9c3c
- @clerk/fastify (npm) Vendor— Affected 3.0.0 to before 3.1.16 Fixed in 3.1.16 Patch available GHSA-w24r-5266-9c3c
- @clerk/express (npm) Vendor— Affected 0.1.0 to before 1.7.79 Fixed in 1.7.79 Patch available GHSA-w24r-5266-9c3c
- @clerk/express (npm) Vendor— Affected 2.0.0 to before 2.1.6 Fixed in 2.1.6 Patch available GHSA-w24r-5266-9c3c
- @clerk/hono (npm) Vendor— Affected 0.0.2 to before 0.1.16 Fixed in 0.1.16 Patch available GHSA-w24r-5266-9c3c
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:clerk:clerk\/astro:*:*:*:*:*:node.js:*:* | 2.0.0 to before 2.17.11; 3.0.0 to before 3.0.18 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/backend:*:*:*:*:*:node.js:*:* | 2.0.0 to before 2.33.3; 3.0.0 to before 3.2.14 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/chrome-extension:*:*:*:*:*:node.js:*:* | 1.3.5 to before 2.9.15; 3.0.0 to before 3.1.15 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/clerk-expo:*:*:*:*:*:node.js:*:* | 2.2.11 to before 2.19.36 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/clerk-js:*:*:*:*:*:node.js:*:* | 5.22.0 to before 5.125.10; 6.0.0 to before 6.7.5 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/clerk-react:*:*:*:*:*:node.js:*:* | 5.9.0 to before 5.61.6 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/expo:*:*:*:*:*:node.js:*:* | 3.0.0 to before 3.2.2 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/express:*:*:*:*:*:node.js:*:* | 0.1.0 to before 1.7.79; 2.0.0 to before 2.1.6 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/fastify:*:*:*:*:*:node.js:*:* | 1.0.42 to before 2.6.31; 3.0.0 to before 3.1.16 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/hono:*:*:*:*:*:node.js:*:* | 0.0.2 to before 0.1.16 | Vulnerable | clerk |
- cpe:2.3:a:clerk:clerk\/astro:*:*:*:*:*:node.js:*:* Versions 2.0.0 to before 2.17.11; 3.0.0 to before 3.0.18 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/backend:*:*:*:*:*:node.js:*:* Versions 2.0.0 to before 2.33.3; 3.0.0 to before 3.2.14 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/chrome-extension:*:*:*:*:*:node.js:*:* Versions 1.3.5 to before 2.9.15; 3.0.0 to before 3.1.15 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/clerk-expo:*:*:*:*:*:node.js:*:* Versions 2.2.11 to before 2.19.36 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/clerk-js:*:*:*:*:*:node.js:*:* Versions 5.22.0 to before 5.125.10; 6.0.0 to before 6.7.5 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/clerk-react:*:*:*:*:*:node.js:*:* Versions 5.9.0 to before 5.61.6 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/expo:*:*:*:*:*:node.js:*:* Versions 3.0.0 to before 3.2.2 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/express:*:*:*:*:*:node.js:*:* Versions 0.1.0 to before 1.7.79; 2.0.0 to before 2.1.6 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/fastify:*:*:*:*:*:node.js:*:* Versions 1.0.42 to before 2.6.31; 3.0.0 to before 3.1.16 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/hono:*:*:*:*:*:node.js:*:* Versions 0.0.2 to before 0.1.16 Vulnerable ·clerk
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:clerk:clerk\/nextjs:*:*:*:*:*:node.js:*:* | 6.0.0 – 6.39.3; 7.0.0 to before 7.2.4 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/nuxt:*:*:*:*:*:node.js:*:* | 1.0.0 to before 1.13.29; 2.0.0 to before 2.2.5 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/react:*:*:*:*:*:node.js:*:* | 6.0.0 to before 6.4.3 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/react-router:*:*:*:*:*:node.js:*:* | 0.0.1 to before 2.4.13; 3.0.0 to before 3.1.4 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/shared:*:*:*:*:*:node.js:*:* | 3.0.0 to before 3.47.5; 4.0.0 to before 4.8.3 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/tanstack-react-start:*:*:*:*:*:node.js:*:* | 0.0.1 to before 0.29.11; 1.0.0 to before 1.1.4 | Vulnerable | clerk |
| cpe:2.3:a:clerk:clerk\/vue:*:*:*:*:*:node.js:*:* | 1.0.0 to before 1.17.21; 2.0.0 to before 2.0.16 | Vulnerable | clerk |
- cpe:2.3:a:clerk:clerk\/nextjs:*:*:*:*:*:node.js:*:* Versions 6.0.0 – 6.39.3; 7.0.0 to before 7.2.4 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/nuxt:*:*:*:*:*:node.js:*:* Versions 1.0.0 to before 1.13.29; 2.0.0 to before 2.2.5 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/react:*:*:*:*:*:node.js:*:* Versions 6.0.0 to before 6.4.3 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/react-router:*:*:*:*:*:node.js:*:* Versions 0.0.1 to before 2.4.13; 3.0.0 to before 3.1.4 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/shared:*:*:*:*:*:node.js:*:* Versions 3.0.0 to before 3.47.5; 4.0.0 to before 4.8.3 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/tanstack-react-start:*:*:*:*:*:node.js:*:* Versions 0.0.1 to before 0.29.11; 1.0.0 to before 1.1.4 Vulnerable ·clerk
- cpe:2.3:a:clerk:clerk\/vue:*:*:*:*:*:node.js:*:* Versions 1.0.0 to before 1.17.21; 2.0.0 to before 2.0.16 Vulnerable ·clerk
Remediation
- Fix · CNA javascript (clerk) Fixed in 5.125.10, 6.7.5
- Fix · GHSA-w24r-5266-9c3c @clerk/shared (npm) Fixed in 3.47.5 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/shared (npm) Fixed in 4.8.3 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/backend (npm) Fixed in 2.33.3 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/backend (npm) Fixed in 3.2.14 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/nextjs (npm) Fixed in 6.39.3 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/nextjs (npm) Fixed in 7.2.4 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/clerk-js (npm) Fixed in 5.125.10 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/clerk-js (npm) Fixed in 6.7.5 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/clerk-react (npm) Fixed in 5.61.6 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/react (npm) Fixed in 6.4.3 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/vue (npm) Fixed in 1.17.21 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/vue (npm) Fixed in 2.0.16 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/astro (npm) Fixed in 2.17.11 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/astro (npm) Fixed in 3.0.18 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/nuxt (npm) Fixed in 1.13.29 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/nuxt (npm) Fixed in 2.2.5 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/clerk-expo (npm) Fixed in 2.19.36 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/expo (npm) Fixed in 3.2.2 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/react-router (npm) Fixed in 2.4.13 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/react-router (npm) Fixed in 3.1.4 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/tanstack-react-start (npm) Fixed in 0.29.11 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/tanstack-react-start (npm) Fixed in 1.1.4 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/chrome-extension (npm) Fixed in 2.9.15 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/chrome-extension (npm) Fixed in 3.1.15 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/fastify (npm) Fixed in 2.6.31 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/fastify (npm) Fixed in 3.1.16 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/express (npm) Fixed in 1.7.79 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/express (npm) Fixed in 2.1.6 Advisory →
- Fix · GHSA-w24r-5266-9c3c @clerk/hono (npm) Fixed in 0.1.16 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42349
- 2026-10-03 Alias added: GHSA-w24r-5266-9c3c
References
Sources
- CVE-2026-42349 · CVE Program
- CVE-2026-42349 · NVD
- FIRST EPSS
- GHSA-w24r-5266-9c3c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences