p PatchFirst

CVE-2026-34076

CVE-2026-34076 · Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5.

CVSS 7.4 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • javascript

    Versions
    • @clerk/hono >= 0.1.0, < 0.1.5: Affected
    • @clerk/express >= 2.0.0, < 2.0.7: Affected
    • @clerk/backend >= 3.0.0, < 3.2.3: Affected
    • @clerk/fastify >= 3.1.0, < 3.1.5: Affected

    No fix published

  • @clerk/backend npm

    Affected ranges
    • SEMVER: ≥ 3.0.0, < 3.2.3

    Update to 3.2.3

  • @clerk/express npm

    Affected ranges
    • SEMVER: ≥ 2.0.0, < 2.0.7

    Update to 2.0.7

  • @clerk/hono npm

    Affected ranges
    • SEMVER: ≥ 0.1.0, < 0.1.5

    Update to 0.1.5

  • @clerk/fastify npm

    Affected ranges
    • SEMVER: ≥ 3.1.0, < 3.1.5

    Update to 3.1.5

Original sources

Check your server →