Clerk

5 CVEs across 22 Clerk products. Browse Clerk vulnerabilities, severities, and proof-of-concept exploits.

Clerk products with known CVEs

ProductCVEs
Javascript4
Astro1
Clerk\/astro1
Clerk\/backend1
Clerk\/chrome-Extension1
Clerk\/clerk-Expo1
Clerk\/clerk-Js1
Clerk\/clerk-React1
Clerk\/expo1
Clerk\/express1
Clerk\/fastify1
Clerk\/hono1
Clerk\/nextjs1
Clerk\/nuxt1
Clerk\/react1
Clerk\/react-Router1
Clerk\/shared1
Clerk\/tanstack-React-Start1
Clerk\/vue1
Nextjs1
Nuxt1
Shared1
Clerk CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-42349High8.12026-05-11Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared…
CVE-2026-41248Critical9.12026-04-24Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypa…
CVE-2026-34076High7.42026-04-01Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versio…
CVE-2025-53548High7.52025-07-09Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting i…
CVE-2024-22206Critical9.02024-01-12Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the P…