@bentwnghk/chat (>=1.91.2, <=1.91.6), @lobehub/chat (>=1.49.5, <=1.49.12) +2 more potentially affected by CVE-2026-42349 via @clerk/nextjs (>=6.3.1, <=6.28.1)

@clerk/nextjs NPM version =6.3.1, =1.91.2, =1.49.5, =0.0.2, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

@clerk/agent-toolkit (>=0.2.9-canary.v20251211104600, <=0.3.16-snapshot.v20260416221307), @clerk/astro (>=3.0.0-canary.v20251211104600, <=3.0.13-snapshot.v20260411110132) +43 more potentially affected by CVE-2026-42349 via @clerk/shared (>=4.0.0, <=4.8.2-snapshot.v20260416221307)

@clerk/shared NPM version =4.0.0, =0.2.9-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-snapshot.v20251216175437, =3.0.0-canary.v20251211104600, =0.4.26-snapshot.v20260226165729, =2.0.0-canary.v20251211104600,...

@unhook/cli (>=0.8.0, <=0.15.0) potentially affected by CVE-2026-42349 via @clerk/express (>=1.5.0, <=1.7.63)

@clerk/express NPM version =1.5.0, =0.8.0, =0.15.0 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

@clerk/chrome-extension (>=3.0.0-canary.v20251211104600, <=3.1.13-snapshot.v20260416221307), @clerk/expo (>=3.0.0-canary.v20251211104600, <=3.2.0-snapshot.v20260416221307) +7 more potentially affected by CVE-2026-42349 via @clerk/react (>=6.0.0-canary.v20251211104600, <=6.4.2-snapshot.v20260416221307)

@clerk/react NPM version =6.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =7.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =1.0.0-canary.v20251211104600, =2.0.0-dev-cli-10, =2.0.0-dev-cli-10, =0.20.1-dev-push, =0.20.3-dev-push,...

@aipmorg/chat (1.5.3), @appconda/react (1.0.242) +52 more potentially affected by CVE-2026-42349 via @clerk/clerk-react (>=5.9.0, <=5.61.3)

@clerk/clerk-react NPM version =5.9.0, =1.34.0, =1.0.0, =1.3.5-canary.v097a1ce, =2.2.11-canary.v097a1ce, =0.19.4-canary.v02b9ae0a47871adccfefb247878691b72e25e929, =1.2.0-staging.0, =0.0.1-canary.v20241209160532, =4.2.26-canary.v097a1ce, =0.12.0-canary.v20250325162153, =0.4.2-canary.v097a1ce,...

Incorrect Authorization

Overview @clerk/nextjs is a Clerk SDK for NextJS Affected versions of this package are vulnerable to Incorrect Authorization through the createProtect and createCheckAuthorization functions. An attacker can gain access to protected pages or handlers by supplying a single auth.protect or has call...

@clerk/chrome-extension (>=1.3.5-canary.v097a1ce, <=2.0.9), @clerk/clerk-expo (>=2.2.11-canary.v097a1ce, <=2.4.5) +12 more potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=5.22.0, <=5.120.0)

@clerk/clerk-js NPM version =5.22.0, =1.3.5-canary.v097a1ce, =2.2.11-canary.v097a1ce, =0.1.0, =0.24.2-dev-clerk, =0.24.2-dev-clerk, =0.24.3-dev-ensure-cloud-token-6, =0.0.5, =0.4.2, =0.19.1-dev-clerk, =0.19.0-dev-clerk, =0.19.0-dev-clerk, =0.8.0, =0.24.2-dev-clerk, =0.19.1-dev-clerk, =0.19.8-dev...

@aurora-nexus/aurora-nexus-design-system (0.2.0), @fireproof/core-protocols-dashboard (>=0.24.3-dev-20261224, <=0.24.12) +6 more potentially affected by CVE-2026-42349 via @clerk/shared (>=3.36.0, <=3.45.1)

@clerk/shared NPM version =3.36.0, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.0.14, =0.18.25-dev, =0.24.3-dev-20261224, =0.18.25-dev, =0.18.28-dev Source cves: CVE-2026-42349 Source advisory: SNYK:JS-CLERKSHARED-16347746...

@aurora-nexus/aurora-nexus-design-system (0.2.0), @fireproof/core-protocols-dashboard (>=0.24.3-dev-20261224, <=0.24.12) +6 more potentially affected by CVE-2026-42349 via @clerk/shared (>=3.36.0, <=3.45.1)

@clerk/shared NPM version =3.36.0, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.0.14, =0.18.25-dev, =0.24.3-dev-20261224, =0.18.25-dev, =0.18.28-dev Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

@maslowai/roster (3.14.0) potentially affected by CVE-2026-42349 via @clerk/express (2.0.8)

@clerk/express NPM version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on @clerk/express and may be impacted: - @maslowai/roster 3.14.0 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

@clerk/chrome-extension (>=1.3.5-canary.v097a1ce, <=2.0.9), @clerk/clerk-expo (>=2.2.11-canary.v097a1ce, <=2.4.5) +12 more potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=5.22.0, <=5.120.0)

@clerk/clerk-js NPM version =5.22.0, =1.3.5-canary.v097a1ce, =2.2.11-canary.v097a1ce, =0.1.0, =0.24.2-dev-clerk, =0.24.2-dev-clerk, =0.24.3-dev-ensure-cloud-token-6, =0.0.5, =0.4.2, =0.19.1-dev-clerk, =0.19.0-dev-clerk, =0.19.0-dev-clerk, =0.8.0, =0.24.2-dev-clerk, =0.19.1-dev-clerk, =0.19.8-dev...

Incorrect Authorization

Overview @clerk/shared is an Internal package utils used by the Clerk SDKs Affected versions of this package are vulnerable to Incorrect Authorization through the createProtect and createCheckAuthorization functions. An attacker can gain access to protected pages or handlers by supplying a single...

PT-2026-36820

Name of the Vulnerable Software and Affected Versions @clerk/clerk-js versions prior to 5.125.10 @clerk/clerk-js versions prior to 6.7.5 @clerk/shared affected versions not specified @clerk/nextjs affected versions not specified @clerk/backend affected versions not specified Description...

CVE-2026-41248

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in...

CVE-2026-41248

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in...

CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in...

CVE-2026-41248

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in...

CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in...

EUVD-2026-25632

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in...

CVE-2026-41248

The CVE-2026-41248 affects Clerk JavaScript repositories: createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by crafted requests, bypassing middleware gating and reaching downstream handlers. Affected fixes are: @clerk/astro 1.5.7, 2.17.10, 3.0.15; @clerk/nextjs 5....