p PatchFirst

CVE-2025-53548

CVE-2025-53548 · @clerk/backend Performs Insufficient Verification of Data Authenticity

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.

CVSS 7.5 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • javascript

    Versions
    • < 2.4.0: Affected

    No fix published

  • @clerk/backend npm

    Affected ranges
    • SEMVER: ≥ 2.0.0, < 2.4.0

    Update to 2.4.0

  • @clerk/astro npm

    Affected ranges
    • SEMVER: ≥ 2.9.0, < 2.10.2

    Update to 2.10.2

  • @clerk/express npm

    Affected ranges
    • SEMVER: ≥ 1.6.0, < 1.7.4

    Update to 1.7.4

  • @clerk/fastify npm

    Affected ranges
    • SEMVER: ≥ 2.3.0, < 2.4.4

    Update to 2.4.4

  • @clerk/nextjs npm

    Affected ranges
    • SEMVER: ≥ 6.2.10, < 6.23.3

    Update to 6.23.3

  • @clerk/nuxt npm

    Affected ranges
    • SEMVER: ≥ 1.7.0, < 1.7.5

    Update to 1.7.5

  • @clerk/react-router npm

    Affected ranges
    • SEMVER: ≥ 1.5.0, < 1.6.4

    Update to 1.6.4

  • @clerk/remix npm

    Affected ranges
    • SEMVER: ≥ 4.8.0, < 4.8.5

    Update to 4.8.5

  • @clerk/tanstack-react-start npm

    Affected ranges
    • SEMVER: ≥ 0.16.0, < 0.18.3

    Update to 0.18.3

Original sources

Check your server →