CVE-2026-42349Clerk JavaScript is the official JavaScript repository for Clerk authentication.
Updated under an hour ago ()
Does this affect you?
It affects clerk/astro and 16 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
- CVSS
- 8.1 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- CWE-754, CWE-863
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
clerk clerk/astro clerk:clerk/astro | from 2.0.0 before 2.17.11; from 3.0.0 before 3.0.18 | NVD |
clerk clerk/backend clerk:clerk/backend | from 2.0.0 before 2.33.3; from 3.0.0 before 3.2.14 | NVD |
clerk clerk/chrome-extension clerk:clerk/chrome-extension | from 1.3.5 before 2.9.15; from 3.0.0 before 3.1.15 | NVD |
clerk clerk/clerk-expo clerk:clerk/clerk-expo | from 2.2.11 before 2.19.36 | NVD |
clerk clerk/clerk-js clerk:clerk/clerk-js | from 5.22.0 before 5.125.10; from 6.0.0 before 6.7.5 | NVD |
clerk clerk/clerk-react clerk:clerk/clerk-react | from 5.9.0 before 5.61.6 | NVD |
clerk clerk/expo clerk:clerk/expo | from 3.0.0 before 3.2.2 | NVD |
clerk clerk/express clerk:clerk/express | from 0.1.0 before 1.7.79; from 2.0.0 before 2.1.6 | NVD |
clerk clerk/fastify clerk:clerk/fastify | from 1.0.42 before 2.6.31; from 3.0.0 before 3.1.16 | NVD |
clerk clerk/hono clerk:clerk/hono | from 0.0.2 before 0.1.16 | NVD |
clerk clerk/nextjs clerk:clerk/nextjs | from 6.0.0 through 6.39.3; from 7.0.0 before 7.2.4 | NVD |
clerk clerk/nuxt clerk:clerk/nuxt | from 1.0.0 before 1.13.29; from 2.0.0 before 2.2.5 | NVD |
clerk clerk/react clerk:clerk/react | from 6.0.0 before 6.4.3 | NVD |
clerk clerk/react-router clerk:clerk/react-router | from 0.0.1 before 2.4.13; from 3.0.0 before 3.1.4 | NVD |
clerk clerk/shared clerk:clerk/shared | from 3.0.0 before 3.47.5; from 4.0.0 before 4.8.3 | NVD |
clerk clerk/tanstack-react-start clerk:clerk/tanstack-react-start | from 0.0.1 before 0.29.11; from 1.0.0 before 1.1.4 | NVD |
clerk clerk/vue clerk:clerk/vue | from 1.0.0 before 1.17.21; from 2.0.0 before 2.0.16 | NVD |
References
- https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3cmitigation, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.