CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2024-22206
Critical (9.8) in clerk javascript. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in @clerk/nextjs 4.29.3.
Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router. This vulnerability was patched in version 4.29.3.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-284, CWE-287, CWE-639
- Published
- Modified
- Record from
- the NVD, synced
Affected
- clerk:javascript
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q6w5-jg5q-47vg | npm | @clerk/nextjs | >=4.7.0 <4.29.3 | 4.29.3 |
References
- https://clerk.com/changelog/2024-01-12
- https://github.com/clerk/javascript/releases/tag/%40clerk%2Fnextjs%404.29.3
- https://github.com/clerk/javascript/security/advisories/GHSA-q6w5-jg5q-47vg
- https://clerk.com/changelog/2024-01-12
- https://github.com/clerk/javascript/releases/tag/%40clerk%2Fnextjs%404.29.3