p PatchFirst

CVE-2026-42349

CVE-2026-42349 · Clerk: Authorization bypass when combining organization, billing, or reverification checks

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.

CVSS 7.6 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • javascript

    Versions
    • >= 5.22.0, < 5.125.10: Affected
    • >= 6.0.0, < 6.7.5: Affected

    No fix published

  • shared

    Versions
    • >= 3.0.0, <= 3.47.4: Affected
    • >= 4.0.0, <= 4.8.2: Affected

    No fix published

  • backend

    Versions
    • >= 2.0.0, <= 2.33.2: Affected
    • >= 3.0.0, <= 3.2.13: Affected

    No fix published

  • nextjs

    Versions
    • >= 6.0.0, <= 6.39.2: Affected
    • >= 7.0.0, <= 7.2.3: Affected

    No fix published

  • clerk-react

    Versions
    • >= 5.9.0, <= 5.61.5: Affected

    No fix published

  • react

    Versions
    • >= 6.0.0, <= 6.4.2: Affected

    No fix published

  • vue

    Versions
    • >= 1.0.0, <= 1.17.20: Affected
    • >= 2.0.0, <= 2.0.15: Affected

    No fix published

  • astro

    Versions
    • >= 2.0.0, <= 2.17.10: Affected
    • >= 3.0.0, <= 3.0.17: Affected

    No fix published

  • nuxt

    Versions
    • >= 1.0.0, <= 1.13.28: Affected
    • >= 2.0.0, <= 2.2.4: Affected

    No fix published

  • clerk-expo

    Versions
    • >= 2.2.11, <= 2.19.35: Affected

    No fix published

  • expo

    Versions
    • >= 3.0.0, <= 3.2.1: Affected

    No fix published

  • react-router

    Versions
    • >= 0.0.1, <= 2.4.12: Affected
    • >= 3.0.0, <= 3.1.3: Affected

    No fix published

  • tanstack-react-start

    Versions
    • >= 0.0.1, <= 0.29.10: Affected
    • >= 1.0.0, <= 1.1.3: Affected

    No fix published

  • chrome-extension

    Versions
    • >= 1.3.5, <= 2.9.14: Affected
    • >= 3.0.0, <= 3.1.14: Affected

    No fix published

  • fastify

    Versions
    • >= 1.0.42, <= 2.6.30: Affected
    • >= 3.0.0, <= 3.1.15: Affected

    No fix published

  • express

    Versions
    • >= 0.1.0, <= 1.7.78: Affected
    • >= 2.0.0, <= 2.1.5: Affected

    No fix published

  • hono

    Versions
    • >= 0.0.2, <= 0.1.15: Affected

    No fix published

  • @clerk/shared npm

    Affected ranges
    • SEMVER: ≥ 3.0.0, < 3.47.5

    Update to 3.47.5

  • @clerk/shared npm

    Affected ranges
    • SEMVER: ≥ 4.0.0, < 4.8.3

    Update to 4.8.3

  • @clerk/backend npm

    Affected ranges
    • SEMVER: ≥ 2.0.0, < 2.33.3

    Update to 2.33.3

  • @clerk/backend npm

    Affected ranges
    • SEMVER: ≥ 3.0.0, < 3.2.14

    Update to 3.2.14

  • @clerk/nextjs npm

    Affected ranges
    • SEMVER: ≥ 6.0.0, < 6.39.3

    Update to 6.39.3

  • @clerk/nextjs npm

    Affected ranges
    • SEMVER: ≥ 7.0.0, < 7.2.4

    Update to 7.2.4

  • @clerk/clerk-js npm

    Affected ranges
    • SEMVER: ≥ 5.22.0, < 5.125.10

    Update to 5.125.10

Original sources

Check your server →