Auth bypass in @Clerk Astro
CVE-2026-42349
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for cert…
EPSS: 0.000 (14.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
- @Clerk Astro — versions >= 2.0.0, <= 2.17.10, >= 3.0.0, <= 3.0.17
- @Clerk Backend — versions >= 2.0.0, <= 2.33.2, >= 3.0.0, <= 3.2.13
- @Clerk Chrome-extension — versions >= 1.3.5, <= 2.9.14, >= 3.0.0, <= 3.1.14
- @Clerk Clerk-expo — versions >= 2.2.11, <= 2.19.35
- @Clerk Clerk-react — versions >= 5.9.0, <= 5.61.5
- @Clerk Expo — versions >= 3.0.0, <= 3.2.1
- @Clerk Express — versions >= 0.1.0, <= 1.7.78, >= 2.0.0, <= 2.1.5
- @Clerk Fastify — versions >= 1.0.42, <= 2.6.30, >= 3.0.0, <= 3.1.15
- @Clerk Hono — versions >= 0.0.2, <= 0.1.15
- @Clerk Nextjs — versions >= 6.0.0, <= 6.39.2, >= 7.0.0, <= 7.2.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-42349?
- CVE-2026-42349 is a high-severity vulnerability in @Clerk Astro, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 8.1/10. Published 2026-05-11.
- How severe is CVE-2026-42349?
- High severity. CVSS v3 base score is 8.1 out of 10.