CVE-2026-42349
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
- CVSS 4.0
- 7.6
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-26)
- CWEs
- CWE-754, CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- clerk:clerk\/astro
- clerk:clerk\/backend
- clerk:clerk\/chrome-extension
- clerk:clerk\/clerk-expo
- clerk:clerk\/clerk-js
- clerk:clerk\/clerk-react
- clerk:clerk\/expo
- clerk:clerk\/express
- clerk:clerk\/fastify
- clerk:clerk\/hono
- clerk:clerk\/nextjs
- clerk:clerk\/nuxt
- clerk:clerk\/react
- clerk:clerk\/react-router
- clerk:clerk\/shared
- clerk:clerk\/tanstack-react-start
- clerk:clerk\/vue
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w24r-5266-9c3c | npm | @clerk/shared | >=3.0.0 <3.47.5 | 3.47.5 |
| GHSA-w24r-5266-9c3c | npm | @clerk/shared | >=4.0.0 <4.8.3 | 4.8.3 |
| GHSA-w24r-5266-9c3c | npm | @clerk/backend | >=2.0.0 <2.33.3 | 2.33.3 |
| GHSA-w24r-5266-9c3c | npm | @clerk/backend | >=3.0.0 <3.2.14 | 3.2.14 |
| GHSA-w24r-5266-9c3c | npm | @clerk/nextjs | >=6.0.0 <6.39.3 | 6.39.3 |
| GHSA-w24r-5266-9c3c | npm | @clerk/nextjs | >=7.0.0 <7.2.4 | 7.2.4 |
| GHSA-w24r-5266-9c3c | npm | @clerk/clerk-js | >=5.22.0 <5.125.10 | 5.125.10 |
| GHSA-w24r-5266-9c3c | npm | @clerk/clerk-js | >=6.0.0 <6.7.5 | 6.7.5 |
| GHSA-w24r-5266-9c3c | npm | @clerk/clerk-react | >=5.9.0 <5.61.6 | 5.61.6 |
| GHSA-w24r-5266-9c3c | npm | @clerk/react | >=6.0.0 <6.4.3 | 6.4.3 |
| GHSA-w24r-5266-9c3c | npm | @clerk/vue | >=1.0.0 <1.17.21 | 1.17.21 |
| GHSA-w24r-5266-9c3c | npm | @clerk/vue | >=2.0.0 <2.0.16 | 2.0.16 |
| GHSA-w24r-5266-9c3c | npm | @clerk/astro | >=2.0.0 <2.17.11 | 2.17.11 |
| GHSA-w24r-5266-9c3c | npm | @clerk/astro | >=3.0.0 <3.0.18 | 3.0.18 |
| GHSA-w24r-5266-9c3c | npm | @clerk/nuxt | >=1.0.0 <1.13.29 | 1.13.29 |
| GHSA-w24r-5266-9c3c | npm | @clerk/nuxt | >=2.0.0 <2.2.5 | 2.2.5 |
| GHSA-w24r-5266-9c3c | npm | @clerk/clerk-expo | >=2.2.11 <2.19.36 | 2.19.36 |
| GHSA-w24r-5266-9c3c | npm | @clerk/expo | >=3.0.0 <3.2.2 | 3.2.2 |
| GHSA-w24r-5266-9c3c | npm | @clerk/react-router | >=0.0.1 <2.4.13 | 2.4.13 |
| GHSA-w24r-5266-9c3c | npm | @clerk/react-router | >=3.0.0 <3.1.4 | 3.1.4 |
| GHSA-w24r-5266-9c3c | npm | @clerk/tanstack-react-start | >=0.0.1 <0.29.11 | 0.29.11 |
| GHSA-w24r-5266-9c3c | npm | @clerk/tanstack-react-start | >=1.0.0 <1.1.4 | 1.1.4 |
| GHSA-w24r-5266-9c3c | npm | @clerk/chrome-extension | >=1.3.5 <2.9.15 | 2.9.15 |
| GHSA-w24r-5266-9c3c | npm | @clerk/chrome-extension | >=3.0.0 <3.1.15 | 3.1.15 |
| GHSA-w24r-5266-9c3c | npm | @clerk/fastify | >=1.0.42 <2.6.31 | 2.6.31 |
| GHSA-w24r-5266-9c3c | npm | @clerk/fastify | >=3.0.0 <3.1.16 | 3.1.16 |
| GHSA-w24r-5266-9c3c | npm | @clerk/express | >=0.1.0 <1.7.79 | 1.7.79 |
| GHSA-w24r-5266-9c3c | npm | @clerk/express | >=2.0.0 <2.1.6 | 2.1.6 |
| GHSA-w24r-5266-9c3c | npm | @clerk/hono | >=0.0.2 <0.1.16 | 0.1.16 |