Skip to content
OpenAdvisories

Package · npm

@clerk/shared

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.6
    CVE-2026-42349

    Clerk: Authorization bypass when combining organization, billing, or reverification checks

    Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authori…

    clerk javascript react astro Browsers npm
  • Critical 9.1
    CVE-2026-41248

    Official Clerk JavaScript SDKs: Middleware-based route protection bypass

    Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handl…

    clerk nextjs nuxt shared npm