clerk express vulnerabilities

Latest clerk express CVEs

Newest publication first

1. CVE-2026-42349 Clerk: Authorization bypass when combining organization, billing, or reverification checks

   Published 2026-05-11

   High·CVSS 7.6 EPSS 0.25%

   Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when th...

2. CVE-2026-34076 Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

   Published 2026-04-01

   High·CVSS 7.4 EPSS 0.32%

   Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to b...

3. CVE-2025-53548 @clerk/backend Performs Insufficient Verification of Data Authenticity

   Published 2025-07-09

   High·CVSS 7.5 EPSS 0.17%

   Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.