Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@clerk/nextjs

4 known vulnerabilities (2 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 critical, 2 high
Weekly downloads
3.6M
Dependents
12
Registry
npm

Advisories 4

  • Clerk: Authorization bypass when combining organization, billing, or reverification checks

    Affected: from 6.0.0, fixed in 6.39.3; from 7.0.0, fixed in 7.2.4.

  • CVE-2026-41248Critical 9.1

    Official Clerk JavaScript SDKs: Middleware-based route protection bypass

    Affected: from 5.0.0, fixed in 5.7.6; from 6.0.0-snapshot.vb87a27f, fixed in 6.39.2; from 7.0.0, fixed in 7.2.1.

  • @clerk/backend Performs Insufficient Verification of Data Authenticity

    Affected: from 6.2.10, fixed in 6.23.3.

  • CVE-2024-22206Critical 9.1

    @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

    Affected: from 4.7.0, fixed in 4.29.3.