p PatchFirst

CVE-2026-34076

CVE-2026-34076 · Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5.

CVSS 7.4 · Alta · EPSS 0,3% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • javascript

    Versiones
    • @clerk/hono >= 0.1.0, < 0.1.5: Afectada
    • @clerk/express >= 2.0.0, < 2.0.7: Afectada
    • @clerk/backend >= 3.0.0, < 3.2.3: Afectada
    • @clerk/fastify >= 3.1.0, < 3.1.5: Afectada

    Sin corrección publicada

  • @clerk/backend npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 3.0.0, < 3.2.3

    Actualiza a 3.2.3

  • @clerk/express npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 2.0.0, < 2.0.7

    Actualiza a 2.0.7

  • @clerk/hono npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 0.1.0, < 0.1.5

    Actualiza a 0.1.5

  • @clerk/fastify npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 3.1.0, < 3.1.5

    Actualiza a 3.1.5

Fuentes originales

Comprueba tu servidor →