CVE-2026-42349: Improper Check for Unusual or Exceptional Conditions

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has, auth.protect, and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be...

coxy (>=0.0.2, <=0.0.4), threed-garden (>=0.17.0-alpha.9, <=0.17.3-centauri.0) potentially affected by CVE-2026-42349 via @clerk/nextjs (>=6.3.1, <=6.28.1)

@clerk/nextjs NPM version =6.3.1, =0.0.2, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2026-42349 Source advisory: SNYK:JS-CLERKNEXTJS-16347747...

coxy (>=0.0.2, <=0.0.4), threed-garden (>=0.17.0-alpha.9, <=0.17.3-centauri.0) potentially affected by CVE-2026-42349 via @clerk/nextjs (>=6.3.1, <=6.28.1)

@clerk/nextjs NPM version =6.3.1, =0.0.2, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

Incorrect Authorization

Overview @clerk/nextjs is a Clerk SDK for NextJS Affected versions of this package are vulnerable to Incorrect Authorization through the createProtect and createCheckAuthorization functions. An attacker can gain access to protected pages or handlers by supplying a single auth.protect or has call...

PT-2026-36820

Name of the Vulnerable Software and Affected Versions @clerk/clerk-js versions prior to 5.125.10 @clerk/clerk-js versions prior to 6.7.5 @clerk/shared affected versions not specified @clerk/nextjs affected versions not specified @clerk/backend affected versions not specified Description...

CVE-2026-41248

The CVE-2026-41248 affects Clerk JavaScript repositories: createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by crafted requests, bypassing middleware gating and reaching downstream handlers. Affected fixes are: @clerk/astro 1.5.7, 2.17.10, 3.0.15; @clerk/nextjs 5....

CVE-2026-41248: Interpretation Conflict

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in...

Incorrect Authorization

Overview @clerk/nextjs is a Clerk SDK for NextJS Affected versions of this package are vulnerable to Incorrect Authorization via the createPathMatcher function in @clerk/shared used by downstream createRouteMatcher. An attacker can gain unauthorized access to protected routes by crafting requests...

@clerk/elements (0.0.2-snapshot.vc65ad98), @spike-npm-land/code (0.9.55) potentially affected by CVE-2026-41248 via @clerk/nextjs (>=5.0.1-snapshot.vc65ad98, <=5.7.5)

@clerk/nextjs NPM version =5.0.1-snapshot.vc65ad98, =5.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on @clerk/nextjs and may be impacted: - @clerk/elements 0.0.2-snapshot.vc65ad98 - @spike-npm-land/code 0.9.55 Source cves: CVE-2026-41248 Source...

coxy (>=0.0.2, <=0.0.4), threed-garden (>=0.17.0-alpha.9, <=0.17.3-centauri.0) potentially affected by CVE-2026-41248 via @clerk/nextjs (>=6.3.1, <=6.28.1)

@clerk/nextjs NPM version =6.3.1, =0.0.2, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2026-41248 Source advisory: SNYK:JS-CLERKNEXTJS-16098250...

coxy (>=0.0.2, <=0.0.4), threed-garden (>=0.17.0-alpha.9, <=0.17.3-centauri.0) potentially affected by CVE-2026-41248 via @clerk/nextjs (>=6.3.1, <=6.28.1)

@clerk/nextjs NPM version =6.3.1, =0.0.2, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2026-41248 Source advisory: OSV:GHSA-VQX2-FGX2-5WQ9...

PT-2026-35323

Summary createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. Sessions are not compromised and no existing user can be impersonated - the bypass only affects the...

threed-garden (>=0.17.0-alpha.9, <=0.17.3-centauri.0) potentially affected by CVE-2025-53548 via @clerk/nextjs (>=6.3.1, <=6.17.0)

@clerk/nextjs NPM version =6.3.1, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2025-53548 Source advisory: OSV:GHSA-9MP4-77WG-RWX9...

GHSA-Q6W5-JG5Q-47VG @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

Impact Unauthorized access or privilege escalation due to a logic flaw in auth in the App Router or getAuth in the Pages Router. Affected Versions All applications that that use @clerk/nextjs versions in the range of = 4.7.0, 4.29.3 in a Next.js backend to authenticate API Routes, App Router, or...

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

Impact Unauthorized access or privilege escalation due to a logic flaw in auth in the App Router or getAuth in the Pages Router. Affected Versions All applications that that use @clerk/nextjs versions in the range of = 4.7.0, 4.29.3 in a Next.js backend to authenticate API Routes, App Router, or...

PT-2024-19274

Name of the Vulnerable Software and Affected Versions Clerk versions prior to 4.29.3 Description The issue is related to unauthorized access or privilege escalation due to a logic flaw in the auth function in the App Router or the getAuth function in the Pages Router. This flaw affects applicatio...