Skip to content
OpenAdvisories
High · 7.5 CVE-2025-53548 EUVD-2025-20865GHSA-9mp4-77wg-rwx9

@clerk/backend Performs Insufficient Verification of Data Authenticity

Published Jul 9, 2025 · Updated Jul 9, 2025 · Assigned by GitHub_M

Vendor: clerk Product: javascript Package: @clerk/astro Package: @clerk/backend Package: @clerk/express Package: @clerk/fastify Package: @clerk/nextjs Package: @clerk/nuxt Package: @clerk/react-router Package: @clerk/remix Package: @clerk/tanstack-react-start Ecosystem: npm

Description

Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.

Affected products

VendorProductAffectedFixed
clerk javascript < 2.4.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm @clerk/astro >= 2.9.0, < 2.10.2 2.10.2 GHSA-9mp4-77wg-rwx9
npm @clerk/backend >= 2.0.0, < 2.4.0 2.4.0 GHSA-9mp4-77wg-rwx9
npm @clerk/express >= 1.6.0, < 1.7.4 1.7.4 GHSA-9mp4-77wg-rwx9
npm @clerk/fastify >= 2.3.0, < 2.4.4 2.4.4 GHSA-9mp4-77wg-rwx9
npm @clerk/nextjs >= 6.2.10, < 6.23.3 6.23.3 GHSA-9mp4-77wg-rwx9
npm @clerk/nuxt >= 1.7.0, < 1.7.5 1.7.5 GHSA-9mp4-77wg-rwx9
npm @clerk/react-router >= 1.5.0, < 1.6.4 1.6.4 GHSA-9mp4-77wg-rwx9
npm @clerk/remix >= 4.8.0, < 4.8.5 4.8.5 GHSA-9mp4-77wg-rwx9
npm @clerk/tanstack-react-start >= 0.16.0, < 0.18.3 0.18.3 GHSA-9mp4-77wg-rwx9

References