{"id":"CVE-2026-42349","revision":null,"records":[{"revision":"333ea7f732494ac2b39dabfa37c96ef6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-42349","aliases":[],"title":"Clerk: Authorization bypass when combining organization, billing, or reverification checks","description":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in  @clerk/clerk-js 5.125.10 and 6.7.5.","state":0,"publishedAt":"2026-05-11T16:08:27.869+00:00","modifiedAt":"2026-05-14T18:19:38.735+00:00","affected":[{"ecosystem":"Vendor product","name":"javascript","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"clerk\",\n                    \"product\": \"javascript\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 5.22.0, < 5.125.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 6.0.0, < 6.7.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"shared","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"shared\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 3.0.0, <= 3.47.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 4.0.0, <= 4.8.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"backend","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"backend\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 2.0.0, <= 2.33.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.0.0, <= 3.2.13\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"nextjs","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"nextjs\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 6.0.0, <= 6.39.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 7.0.0, <= 7.2.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"clerk-react","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"clerk-react\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 5.9.0, <= 5.61.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"react\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 6.0.0, <= 6.4.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"vue","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"vue\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.0.0, <= 1.17.20\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 2.0.0, <= 2.0.15\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"astro","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"astro\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 2.0.0, <= 2.17.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.0.0, <= 3.0.17\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"nuxt","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"nuxt\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.0.0, <= 1.13.28\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 2.0.0, <= 2.2.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"clerk-expo","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"clerk-expo\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 2.2.11, <= 2.19.35\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"expo","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"expo\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 3.0.0, <= 3.2.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-router","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"react-router\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.0.1, <= 2.4.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.0.0, <= 3.1.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"tanstack-react-start","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"tanstack-react-start\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.0.1, <= 0.29.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.0.0, <= 1.1.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"chrome-extension","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"chrome-extension\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.3.5, <= 2.9.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.0.0, <= 3.1.14\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"fastify","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"fastify\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.0.42, <= 2.6.30\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.0.0, <= 3.1.15\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"express","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"express\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.1.0, <= 1.7.78\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 2.0.0, <= 2.1.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"hono","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@clerk\",\n                    \"product\": \"hono\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.0.2, <= 0.1.15\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.6,"severity":"HIGH"}],"references":["https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-42349","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-42349","identifiers":["CVE-2026-42349"]},"retained":false,"historicalAffected":[]},{"revision":"1b93795778c14a10b2386df6a2cb10e8","observedAt":"2026-11-07T09:34:07.425+00:00","statement":{"source":"euvd","id":"EUVD-2026-29125","aliases":["CVE-2026-42349","GHSA-w24r-5266-9c3c"],"title":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certa…","description":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in  @clerk/clerk-js 5.125.10 and 6.7.5.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.6,"severity":null}],"references":["https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29125","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 11, 2026, 4:08:27 PM","dateUpdated":"May 14, 2026, 6:19:38 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-29125","identifiers":["EUVD-2026-29125","CVE-2026-42349","GHSA-w24r-5266-9c3c"]},"retained":false,"historicalAffected":[]},{"revision":"77790db6c7294623aa3929f8ab3cbb42","observedAt":"2026-10-27T11:12:01.124+00:00","statement":{"source":"nvd","id":"CVE-2026-42349","aliases":[],"title":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certa…","description":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in  @clerk/clerk-js 5.125.10 and 6.7.5.","state":0,"publishedAt":"2026-05-11T17:16:33.147+00:00","modifiedAt":"2026-10-26T18:10:00.173+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.6,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1,"severity":"HIGH"}],"references":["https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42349","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-754","CWE-863"],"productCriteria":["cpe:2.3:a:clerk:clerk\\/astro:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/backend:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/chrome-extension:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/clerk-expo:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/clerk-js:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/clerk-react:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/expo:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/express:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/fastify:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/hono:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/nextjs:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/nuxt:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/react:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/react-router:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/shared:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/tanstack-react-start:*:*:*:*:*:node.js:*:*","cpe:2.3:a:clerk:clerk\\/vue:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-05-11T17:16:33.147","lastModified":"2026-10-26T18:10:00.173"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-42349","identifiers":["CVE-2026-42349"]},"retained":false,"historicalAffected":[]},{"revision":"0c1a773b7a0b451d930eb138cbda0142","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-w24r-5266-9c3c","aliases":["CVE-2026-42349"],"title":"Clerk has an authorization bypass when combining organization, billing, or reverification checks","description":"### Summary\n\n`has()`, `auth.protect()`, and related authorization predicates in `@clerk/shared`, `@clerk/nextjs`, `@clerk/backend`, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions.\n\nSessions are not compromised and no existing user can be impersonated. The bypass is limited to the authorization decision returned by the predicate. `clerkMiddleware` continues to authenticate requests correctly, `auth()` reflects the real authentication state, and token verification is unaffected.\n\n### Who is affected\n\nAll apps that combine more than one authorization dimension in a single `has()` or `auth.protect()` call should upgrade to the patched versions. Patches are drop-in with no API changes. The information below describes the scope of the bypass and helps developers understand whether their apps are potentially affected, but is not a reason to delay the upgrade.\n\nThis call shape can be bypassed if certain conditions are met: a `has()` or `auth.protect()` call that combines a `reverification` check with any of `role`, `permission`, `feature`, or `plan`, or that combines a billing check (`feature` or `plan`) with a role or permission check.\n\n\n```ts\n// Reverification combined with role / permission / feature / plan\nawait auth.protect({ permission: 'org:settings:delete', reverification: 'strict' });\nconst canAct = has({ role: 'org:admin', reverification: 'strict' });\n\n// Billing (feature / plan) combined with role / permission\nconst canAct = has({ permission: 'org:admin', feature: 'premium' });\n```\n\nSingle-condition checks are not affected and continue to fail closed as expected:\n\n```ts\nawait auth.protect({ permission: 'org:settings:delete' });\nhas({ reverification: 'strict' });\n```\n\nThe callback form of `auth.protect` is not affected unless the callback itself invokes one of the affected shapes:\n\n```ts\nawait auth.protect(has => has({ permission: 'org:X' }) && has({ reverification: 'strict' }));\n```\n\nApp patterns that rely only on single-condition checks, or that combine them via the callback form, are unaffected. Authentication, session state, and token verification continue to work correctly regardless of this bypass.\n\n`@clerk/shared` is usually not imported directly in application code, but the fix lives there and reaches an app through its framework package. If developers import `createCheckAuthorization` from `@clerk/shared` directly, their apps are also affected. Run `npm why @clerk/shared` (or the app's package manager's equivalent) to check the installed version.\n\n### Additional `auth.protect()` bypass\n\nA second, related bypass lives in `@clerk/nextjs`: `auth.protect()` silently discarded authorization params (`role`, `permission`, `feature`, `plan`, `reverification`) whenever the same argument object also contained `unauthenticatedUrl`, `unauthorizedUrl`, or `token`.\n\n### Recommended actions\n\nUpgrade to the latest patch release of the consuming app's framework package on its current major. Both Core 2 and Core 3 release lines have patches. See the \"Affected packages\" section above for the exact vulnerable ranges and patched versions per package.\n\nIf a consuming app pins `@clerk/clerk-js` directly, upgrade it to the patched version. Most apps load `@clerk/clerk-js` from Clerk's CDN through their framework package and will receive the fix automatically, with no upgrade step required.\n\n### Workaround\n\nIf developers cannot upgrade immediately, split combined `has()` or `auth.protect()` calls into sequential single-condition checks:\n\n```ts\n// Replace\nawait auth.protect({ permission: 'org:X', reverification: 'strict' });\n// With\nawait auth.protect({ reverification: 'strict' });\nawait auth.protect({ permission: 'org:X' });\n```\n\nEach single-condition check fails closed as expected, so evaluating them independently and denying if either fails produces the correct result.\n\n### Timeline\n\nThis issue was reported on 18 APR 2026, patched on 22 APR 2026, and publicly disclosed on 22 APR 2026.\n\nThanks to AISafe for the responsible disclosure of this vulnerability.","state":0,"publishedAt":"2026-04-30T18:20:02+00:00","modifiedAt":"2026-09-10T03:51:03.6722531+00:00","affected":[{"ecosystem":"npm","name":"@clerk/shared","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.47.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/shared","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.8.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.33.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.2.14"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/nextjs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"6.0.0"},{"kind":"fixed","version":"6.39.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/nextjs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.0.0"},{"kind":"fixed","version":"7.2.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/clerk-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"5.22.0"},{"kind":"fixed","version":"5.125.10"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/clerk-js","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"6.0.0"},{"kind":"fixed","version":"6.7.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/clerk-react","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"5.9.0"},{"kind":"fixed","version":"5.61.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/react","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"6.0.0"},{"kind":"fixed","version":"6.4.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/vue","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"},{"kind":"fixed","version":"1.17.21"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/vue","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.0.16"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/astro","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.17.11"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/astro","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.0.18"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/nuxt","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"},{"kind":"fixed","version":"1.13.29"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/nuxt","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.2.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/clerk-expo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.2.11"},{"kind":"fixed","version":"2.19.36"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/expo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.2.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/react-router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.1"},{"kind":"fixed","version":"2.4.13"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/react-router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.1.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/tanstack-react-start","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.1"},{"kind":"fixed","version":"0.29.11"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/tanstack-react-start","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"},{"kind":"fixed","version":"1.1.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/chrome-extension","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.3.5"},{"kind":"fixed","version":"2.9.15"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/chrome-extension","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.1.15"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/fastify","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.42"},{"kind":"fixed","version":"2.6.31"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/fastify","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.1.16"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/express","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.1.0"},{"kind":"fixed","version":"1.7.79"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/express","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.1.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@clerk/hono","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.2"},{"kind":"fixed","version":"0.1.16"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c","https://nvd.nist.gov/vuln/detail/CVE-2026-42349","https://github.com/clerk/javascript"],"sourceUrl":"https://github.com/advisories/GHSA-w24r-5266-9c3c","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-w24r-5266-9c3c","identifiers":["GHSA-w24r-5266-9c3c","CVE-2026-42349"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T16:07:52.6079466+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T16:07:52.6079466+00:00","lastSuccessAt":"2026-11-07T16:07:52.8396759+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.8396778+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-c173d89a3f1a0bdb31cd68e866be332a5016302f586ede89a35ec193ac99504a","complete":true,"records":420933,"lastAttemptAt":"2026-11-07T16:07:52.127477+00:00","lastSuccessAt":"2026-11-07T16:07:52.0557652+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.127477+00:00","snapshotPublishedAt":"2026-11-07T15:22:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-bee3dfbd77fe4043986590b0e0b76259","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T16:18:44.6437051+00:00","lastSuccessAt":"2026-11-07T16:18:44.639+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:18:44.639+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T16:07:52.6079466+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T16:07:52.6079466+00:00","lastSuccessAt":"2026-11-07T16:07:58.5710341+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:58.5710358+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e1c431e1022f4db1b4e459e61c31a4ca","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T16:08:00.6485737+00:00","lastSuccessAt":"2026-11-07T16:08:00.644+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:08:00.644+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T16:07:52.5107257+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.5107257+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T16:07:52.2947928+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.2947928+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T16:07:52.5258708+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.5258708+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T16:07:52.4004477+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.4004477+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}