Skip to content
@@clerk
Products
| Product | CVEs | Exploited | Latest |
|---|
| javascript | 4 | – | May 11, 2026 |
| nextjs | 2 | – | May 11, 2026 |
| shared | 2 | – | May 11, 2026 |
| nuxt | 2 | – | May 11, 2026 |
| astro | 2 | – | May 11, 2026 |
| expo | 1 | – | May 11, 2026 |
| express | 1 | – | May 11, 2026 |
| fastify | 1 | – | May 11, 2026 |
| hono | 1 | – | May 11, 2026 |
| react | 1 | – | May 11, 2026 |
| react-router | 1 | – | May 11, 2026 |
| tanstack-react-start | 1 | – | May 11, 2026 |
| vue | 1 | – | May 11, 2026 |
| backend | 1 | – | May 11, 2026 |
| chrome-extension | 1 | – | May 11, 2026 |
| clerk-expo | 1 | – | May 11, 2026 |
| clerk-react | 1 | – | May 11, 2026 |
Exploited and recent CVEs
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-42349
High 7.6
Clerk: Authorization bypass when combining organization, billing, or reverification checks
0.2%
-
CVE-2026-41248
Critical 9.1
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
0.3%
-
CVE-2026-41248
Critical 9.1
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
0.3%
-
CVE-2026-41248
Critical 9.1
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
0.3%
-
CVE-2026-41248
Critical 9.1
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
0.3%
-
CVE-2026-34076
High 7.4
Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
0.3%
-
CVE-2025-53548
High 7.5
@clerk/backend Performs Insufficient Verification of Data Authenticity
0.2%
-
CVE-2024-22206
Critical 9.1
@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
0.7%