{"id":"EUVD-2026-17974","enisaUuid":"783e20b7-ef2c-3d14-bab8-7aee0a8bff6e","description":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application\u0027s Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5.","datePublished":"Apr 1, 2026, 4:59:21 PM","dateUpdated":"Apr 1, 2026, 6:00:23 PM","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/clerk/javascript/security/advisories/GHSA-gjxx-92w9-8v8f\n","aliases":"CVE-2026-34076\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"bc71268b-e1ba-3cf1-9d6a-a6e784846204","product":{"name":"javascript","vendor":{"name":"clerk"}},"product_version":"@clerk/backend  3.0.0, \u003c 3.2.3"},{"id":"d471c34b-6094-3132-a984-cb142bdb31cb","product":{"name":"javascript","vendor":{"name":"clerk"}},"product_version":"@clerk/hono  0.1.0, \u003c 0.1.5"},{"id":"e9ab2552-72e1-3f89-95f1-81c762434b13","product":{"name":"javascript","vendor":{"name":"clerk"}},"product_version":"@clerk/express  2.0.0, \u003c 2.0.7"},{"id":"f138f8c3-85d1-3811-8b8a-2574dce43d34","product":{"name":"javascript","vendor":{"name":"clerk"}},"product_version":"@clerk/fastify  3.1.0, \u003c 3.1.5"}],"enisaIdVendor":[{"id":"c0a6093a-f2f0-3136-809f-0f004c9fe00d","vendor":{"name":"clerk"}}],"enisaIdVulnerability":[{"id":"de14b598-0d3d-36dd-8ff6-d26ef54b36ab","vulnerability":{"id":"CVE-2026-34076","description":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application\u0027s Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5.","datePublished":"Apr 1, 2026, 4:59:21 PM","dateUpdated":"Apr 1, 2026, 6:00:23 PM","status":"PUBLISHED","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/clerk/javascript/security/advisories/GHSA-gjxx-92w9-8v8f\n","enisa_id":"EUVD-2026-17974\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Oct 30, 2026, 7:19:09 AM","vulnerabilityProduct":[{"id":"0551c8b7-2b0a-349f-a9ed-2f51ea2e20b0","product":{"name":"javascript","vendor":{"name":"clerk"}},"product_version":"@clerk/fastify  3.1.0, \u003c 3.1.5"},{"id":"25143f82-358c-3a38-a4cf-7cb28527e411","product":{"name":"javascript","vendor":{"name":"clerk"}},"product_version":"@clerk/express  2.0.0, \u003c 2.0.7"},{"id":"771b6981-89c2-3e18-9168-e954d6582968","product":{"name":"javascript","vendor":{"name":"clerk"}},"product_version":"@clerk/backend  3.0.0, \u003c 3.2.3"},{"id":"b99b8dae-b04b-37bd-904e-f0e9c0eb4b17","product":{"name":"javascript","vendor":{"name":"clerk"}},"product_version":"@clerk/hono  0.1.0, \u003c 0.1.5"}],"vulnerabilityVendor":[{"id":"45412254-eaf0-3cdc-96cc-bd925f535d82","vendor":{"name":"clerk"}}]}}],"enisaIdAdvisory":[]}