{"id":"EUVD-2026-29125","enisaUuid":"2735bad5-29cd-3c4c-935e-6429a5eaa0b6","description":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in  @clerk/clerk-js 5.125.10 and 6.7.5.","datePublished":"May 11, 2026, 4:08:27 PM","dateUpdated":"May 14, 2026, 6:19:38 PM","baseScore":7.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c\n","aliases":"CVE-2026-42349\nGHSA-w24r-5266-9c3c\n","assigner":"GitHub_M","epss":0.25,"enisaIdProduct":[{"id":"1173b12c-c6dd-339f-88b4-7f1babac623e","product":{"name":"React","vendor":{"name":"@clerk"}},"product_version":"6.0.0, ≤ 6.4.2"},{"id":"19a19f96-82d8-3f8e-a9be-a9fefbfc6726","product":{"name":"tanstack-react-start","vendor":{"name":"@clerk"}},"product_version":"1.0.0, ≤ 1.1.3"},{"id":"1cf2a4a2-a137-31ab-9aae-f7a35f422669","product":{"name":"express","vendor":{"name":"@clerk"}},"product_version":"0.1.0, ≤ 1.7.78"},{"id":"1fe10d74-4f0f-3920-84bf-c2326b8b353c","product":{"name":"javascript","vendor":{"name":"clerk"}},"product_version":"6.0.0, \u003c 6.7.5"},{"id":"25553931-a628-30a2-bd30-91d062384137","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"1.0.0, ≤ 1.13.28"},{"id":"30f5014d-b8dc-3621-9cf6-8f31f5c4d9ab","product":{"name":"nextjs","vendor":{"name":"@clerk"}},"product_version":"6.0.0, ≤ 6.39.2"},{"id":"3543c753-f504-3d0b-9fd2-daa369a3058a","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"2.0.0, ≤ 2.17.10"},{"id":"3bbb2366-c0fc-3c26-8a69-5f84d2fdd996","product":{"name":"express","vendor":{"name":"@clerk"}},"product_version":"2.0.0, ≤ 2.1.5"},{"id":"51c8536a-7016-32be-aab9-92c0d870b5eb","product":{"name":"chrome-extension","vendor":{"name":"@clerk"}},"product_version":"1.3.5, ≤ 2.9.14"},{"id":"59c862ab-8764-35aa-b611-732cbec2d299","product":{"name":"nextjs","vendor":{"name":"@clerk"}},"product_version":"7.0.0, ≤ 7.2.3"},{"id":"650f4e52-ad8f-3514-ace8-5566876813c0","product":{"name":"react-router","vendor":{"name":"@tanstack"}},"product_version":"0.0.1, ≤ 2.4.12"},{"id":"6541cd7b-4d17-3313-943f-05390488057b","product":{"name":"expo","vendor":{"name":"@clerk"}},"product_version":"3.0.0, ≤ 3.2.1"},{"id":"696a586f-1d15-3341-94eb-dbdd2ff97229","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"0.0.2, ≤ 0.1.15"},{"id":"747cbb4f-95a9-3265-8039-30411dbc835b","product":{"name":"shared","vendor":{"name":"@clerk"}},"product_version":"3.0.0, ≤ 3.47.4"},{"id":"75628f96-86aa-3ed0-bc15-0b4093b11523","product":{"name":"clerk-expo","vendor":{"name":"@clerk"}},"product_version":"2.2.11, ≤ 2.19.35"},{"id":"75cffb4a-f665-33e8-97cc-3699133d886c","product":{"name":"javascript","vendor":{"name":"clerk"}},"product_version":"5.22.0, \u003c 5.125.10"},{"id":"77fa6d77-b255-3a64-84bc-f83248e19905","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"3.0.0, ≤ 3.0.17"},{"id":"7ac7bf80-23b9-3323-906b-072811dbd077","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"2.0.0, ≤ 2.2.4"},{"id":"80b75aa3-0e25-35cb-942a-65937533af14","product":{"name":"chrome-extension","vendor":{"name":"@clerk"}},"product_version":"3.0.0, ≤ 3.1.14"},{"id":"8d6a46b5-7ec2-3b23-ad6d-01091a6eae23","product":{"name":"vue","vendor":{"name":"@clerk"}},"product_version":"1.0.0, ≤ 1.17.20"},{"id":"9d3b9134-1c5a-3f16-8b04-41de7ce1f52f","product":{"name":"backend","vendor":{"name":"@clerk"}},"product_version":"3.0.0, ≤ 3.2.13"},{"id":"a7963b59-ac31-3e41-8a4d-413cc49de3f5","product":{"name":"fastify","vendor":{"name":"@clerk"}},"product_version":"3.0.0, ≤ 3.1.15"},{"id":"b8fb4bfe-8168-3f6b-a010-c8c6f7967475","product":{"name":"backend","vendor":{"name":"@clerk"}},"product_version":"2.0.0, ≤ 2.33.2"},{"id":"c639d631-b402-3a7a-8b1e-9eb26f975844","product":{"name":"react-router","vendor":{"name":"@tanstack"}},"product_version":"3.0.0, ≤ 3.1.3"},{"id":"cd89247d-ec55-387e-8099-13c3780fd465","product":{"name":"fastify","vendor":{"name":"@clerk"}},"product_version":"1.0.42, ≤ 2.6.30"},{"id":"ed4cc310-ad85-36ce-a3ef-404d17ba32bd","product":{"name":"tanstack-react-start","vendor":{"name":"@clerk"}},"product_version":"0.0.1, ≤ 0.29.10"},{"id":"eea96d2b-0591-379f-994a-376e0ce4e54a","product":{"name":"shared","vendor":{"name":"@clerk"}},"product_version":"4.0.0, ≤ 4.8.2"},{"id":"f5e60094-d0bb-38ac-beee-d925de025219","product":{"name":"clerk-react","vendor":{"name":"@clerk"}},"product_version":"5.9.0, ≤ 5.61.5"},{"id":"f63dde41-4ffb-3c06-a645-536b5929e769","product":{"name":"vue","vendor":{"name":"@clerk"}},"product_version":"2.0.0, ≤ 2.0.15"}],"enisaIdVendor":[{"id":"2311f777-b206-3d26-9a43-66c2acca9b75","vendor":{"name":"clerk"}},{"id":"74216f45-02da-3d8d-b988-429b8646e921","vendor":{"name":"@clerk"}}],"enisaIdVulnerability":[{"id":"892694ab-641e-3b08-b784-108f84b77ef4","vulnerability":{"id":"GHSA-w24r-5266-9c3c","description":"Clerk has an authorization bypass when combining organization, billing, or reverification checks","datePublished":"Apr 30, 2026, 6:20:02 PM","dateUpdated":"Jun 9, 2026, 10:49:55 AM","baseScore":0.0,"references":"https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42349\nhttps://github.com/clerk/javascript\n","enisa_id":"EUVD-2026-29125\n","aliases":"CVE-2026-42349\nGHSA-w24r-5266-9c3c\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c99f1da8-0826-3351-9a91-7f0a3e112e11","vulnerability":{"id":"CVE-2026-42349","description":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in  @clerk/clerk-js 5.125.10 and 6.7.5.","datePublished":"May 11, 2026, 4:08:27 PM","dateUpdated":"May 14, 2026, 6:19:38 PM","status":"PUBLISHED","baseScore":7.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c\n","enisa_id":"EUVD-2026-29125\n","assigner":"GitHub_M","epss":0.25,"dataProcessed":"Nov 1, 2026, 7:17:53 AM","vulnerabilityProduct":[{"id":"01d54bfd-b518-32c5-9adf-a3c3144177ca","product":{"name":"shared","vendor":{"name":"@clerk"}},"product_version":"4.0.0, ≤ 4.8.2"},{"id":"161f1c92-1de0-323d-ab7c-9886bc882562","product":{"name":"react-router","vendor":{"name":"@tanstack"}},"product_version":"3.0.0, ≤ 3.1.3"},{"id":"18dd7236-09d9-3a74-a219-2369af75dd8d","product":{"name":"React","vendor":{"name":"@clerk"}},"product_version":"6.0.0, ≤ 6.4.2"},{"id":"33b9fdf0-eb45-34fa-85e5-6ec126a84dd3","product":{"name":"javascript","vendor":{"name":"clerk"}},"product_version":"5.22.0, \u003c 5.125.10"},{"id":"39cc00a8-b9e9-3ea0-951e-f5814a52238b","product":{"name":"backend","vendor":{"name":"@clerk"}},"product_version":"2.0.0, ≤ 2.33.2"},{"id":"3f01c10e-f321-3b59-927d-82f5a524e537","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"2.0.0, ≤ 2.2.4"},{"id":"42938536-55e1-3333-bb60-921bab48993a","product":{"name":"vue","vendor":{"name":"@clerk"}},"product_version":"2.0.0, ≤ 2.0.15"},{"id":"50a4b93f-90dc-31b0-8f14-91c6600c90dc","product":{"name":"fastify","vendor":{"name":"@clerk"}},"product_version":"1.0.42, ≤ 2.6.30"},{"id":"6430ca09-e667-3493-bf24-4aa6598ce7d2","product":{"name":"hono","vendor":{"name":"honojs"}},"product_version":"0.0.2, ≤ 0.1.15"},{"id":"685bbf3e-a50a-32f7-9b30-5d774adad659","product":{"name":"chrome-extension","vendor":{"name":"@clerk"}},"product_version":"3.0.0, ≤ 3.1.14"},{"id":"6f68cad1-ed7e-3063-bad8-a8940dd4017d","product":{"name":"nextjs","vendor":{"name":"@clerk"}},"product_version":"6.0.0, ≤ 6.39.2"},{"id":"7b40e845-8ac1-3c42-a96f-63b7553f2669","product":{"name":"expo","vendor":{"name":"@clerk"}},"product_version":"3.0.0, ≤ 3.2.1"},{"id":"7d05a3a8-9844-349b-91be-264daf962575","product":{"name":"nextjs","vendor":{"name":"@clerk"}},"product_version":"7.0.0, ≤ 7.2.3"},{"id":"8aae2e3e-7e5a-3d45-8e12-2f5c790e6117","product":{"name":"tanstack-react-start","vendor":{"name":"@clerk"}},"product_version":"0.0.1, ≤ 0.29.10"},{"id":"8bc7ebda-ff80-3136-a085-685eda2dd495","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"3.0.0, ≤ 3.0.17"},{"id":"aac7bd7c-01e3-390d-88f1-bb883099ab7c","product":{"name":"chrome-extension","vendor":{"name":"@clerk"}},"product_version":"1.3.5, ≤ 2.9.14"},{"id":"b3fdd755-5da3-3f25-aa1c-1ff5c72e9dcc","product":{"name":"express","vendor":{"name":"@clerk"}},"product_version":"2.0.0, ≤ 2.1.5"},{"id":"ba62657e-fdea-36a6-948a-9f0034e35578","product":{"name":"fastify","vendor":{"name":"@clerk"}},"product_version":"3.0.0, ≤ 3.1.15"},{"id":"bdf37f6b-a583-306b-a4f6-c22a497249e3","product":{"name":"express","vendor":{"name":"@clerk"}},"product_version":"0.1.0, ≤ 1.7.78"},{"id":"bfb9ca22-3bb0-377e-8c96-8b4fe86b74ad","product":{"name":"react-router","vendor":{"name":"@tanstack"}},"product_version":"0.0.1, ≤ 2.4.12"},{"id":"c82bb701-c46b-31d8-97cf-cb66eb1cd2ec","product":{"name":"clerk-react","vendor":{"name":"@clerk"}},"product_version":"5.9.0, ≤ 5.61.5"},{"id":"ce28dd44-f3f8-344b-92c4-27bfd8b6466e","product":{"name":"javascript","vendor":{"name":"clerk"}},"product_version":"6.0.0, \u003c 6.7.5"},{"id":"ce49cc0b-8889-3405-acef-28b2e1ae4d2c","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"2.0.0, ≤ 2.17.10"},{"id":"cf5230cf-bbdb-34ac-959a-dbeccd5c2c6f","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"1.0.0, ≤ 1.13.28"},{"id":"d5f8d91d-bbda-3202-aee9-d2dcce8146c4","product":{"name":"clerk-expo","vendor":{"name":"@clerk"}},"product_version":"2.2.11, ≤ 2.19.35"},{"id":"d8b5c497-baa8-3778-8ef7-d933719399ea","product":{"name":"vue","vendor":{"name":"@clerk"}},"product_version":"1.0.0, ≤ 1.17.20"},{"id":"f02b0206-5162-37a8-bc0b-148e3c8b4019","product":{"name":"shared","vendor":{"name":"@clerk"}},"product_version":"3.0.0, ≤ 3.47.4"},{"id":"f38a360a-e5bb-3404-8d72-f39f8122ea7d","product":{"name":"backend","vendor":{"name":"@clerk"}},"product_version":"3.0.0, ≤ 3.2.13"},{"id":"f9c025b4-ae4a-3043-90fc-f14fb6780b62","product":{"name":"tanstack-react-start","vendor":{"name":"@clerk"}},"product_version":"1.0.0, ≤ 1.1.3"}],"vulnerabilityVendor":[{"id":"29d3b655-e4c9-3c51-89f5-c17014b2f494","vendor":{"name":"@clerk"}},{"id":"53d73c58-d695-3283-bef9-bd16d7596c4c","vendor":{"name":"clerk"}}]}}],"enisaIdAdvisory":[]}