EUVD-2026-29125Published

Clerk: Authorization bypass when combining organization, billing, or reverification checks

cve-program · CVE-2026-42349

Published

javascript

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "clerk",
                    "product": "javascript",
                    "versions": [
                        {
                            "version": ">= 5.22.0, < 5.125.10",
                            "status": "affected"
                        },
                        {
                            "version": ">= 6.0.0, < 6.7.5",
                            "status": "affected"
                        }
                    ]
                }

shared

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "shared",
                    "versions": [
                        {
                            "version": ">= 3.0.0, <= 3.47.4",
                            "status": "affected"
                        },
                        {
                            "version": ">= 4.0.0, <= 4.8.2",
                            "status": "affected"
                        }
                    ]
                }

backend

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "backend",
                    "versions": [
                        {
                            "version": ">= 2.0.0, <= 2.33.2",
                            "status": "affected"
                        },
                        {
                            "version": ">= 3.0.0, <= 3.2.13",
                            "status": "affected"
                        }
                    ]
                }

nextjs

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "nextjs",
                    "versions": [
                        {
                            "version": ">= 6.0.0, <= 6.39.2",
                            "status": "affected"
                        },
                        {
                            "version": ">= 7.0.0, <= 7.2.3",
                            "status": "affected"
                        }
                    ]
                }

clerk-react

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "clerk-react",
                    "versions": [
                        {
                            "version": ">= 5.9.0, <= 5.61.5",
                            "status": "affected"
                        }
                    ]
                }

react

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "react",
                    "versions": [
                        {
                            "version": ">= 6.0.0, <= 6.4.2",
                            "status": "affected"
                        }
                    ]
                }

vue

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "vue",
                    "versions": [
                        {
                            "version": ">= 1.0.0, <= 1.17.20",
                            "status": "affected"
                        },
                        {
                            "version": ">= 2.0.0, <= 2.0.15",
                            "status": "affected"
                        }
                    ]
                }

astro

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "astro",
                    "versions": [
                        {
                            "version": ">= 2.0.0, <= 2.17.10",
                            "status": "affected"
                        },
                        {
                            "version": ">= 3.0.0, <= 3.0.17",
                            "status": "affected"
                        }
                    ]
                }

nuxt

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "nuxt",
                    "versions": [
                        {
                            "version": ">= 1.0.0, <= 1.13.28",
                            "status": "affected"
                        },
                        {
                            "version": ">= 2.0.0, <= 2.2.4",
                            "status": "affected"
                        }
                    ]
                }

clerk-expo

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "clerk-expo",
                    "versions": [
                        {
                            "version": ">= 2.2.11, <= 2.19.35",
                            "status": "affected"
                        }
                    ]
                }

expo

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "expo",
                    "versions": [
                        {
                            "version": ">= 3.0.0, <= 3.2.1",
                            "status": "affected"
                        }
                    ]
                }

react-router

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "react-router",
                    "versions": [
                        {
                            "version": ">= 0.0.1, <= 2.4.12",
                            "status": "affected"
                        },
                        {
                            "version": ">= 3.0.0, <= 3.1.3",
                            "status": "affected"
                        }
                    ]
                }

tanstack-react-start

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "tanstack-react-start",
                    "versions": [
                        {
                            "version": ">= 0.0.1, <= 0.29.10",
                            "status": "affected"
                        },
                        {
                            "version": ">= 1.0.0, <= 1.1.3",
                            "status": "affected"
                        }
                    ]
                }

chrome-extension

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "chrome-extension",
                    "versions": [
                        {
                            "version": ">= 1.3.5, <= 2.9.14",
                            "status": "affected"
                        },
                        {
                            "version": ">= 3.0.0, <= 3.1.14",
                            "status": "affected"
                        }
                    ]
                }

fastify

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "fastify",
                    "versions": [
                        {
                            "version": ">= 1.0.42, <= 2.6.30",
                            "status": "affected"
                        },
                        {
                            "version": ">= 3.0.0, <= 3.1.15",
                            "status": "affected"
                        }
                    ]
                }

express

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "express",
                    "versions": [
                        {
                            "version": ">= 0.1.0, <= 1.7.78",
                            "status": "affected"
                        },
                        {
                            "version": ">= 2.0.0, <= 2.1.5",
                            "status": "affected"
                        }
                    ]
                }

hono

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "@clerk",
                    "product": "hono",
                    "versions": [
                        {
                            "version": ">= 0.0.2, <= 0.1.15",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-29125

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: May 11, 2026, 4:08:27 PM

dateUpdated: May 14, 2026, 6:19:38 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-42349

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-754 · CWE-863

Original publisher date fields

published: 2026-05-11T17:16:33.147

lastModified: 2026-10-26T18:10:00.173

17 source CPE criteria · context only

cpe:2.3:a:clerk:clerk\/astro:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/backend:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/chrome-extension:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/clerk-expo:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/clerk-js:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/clerk-react:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/expo:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/express:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/fastify:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/hono:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/nextjs:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/nuxt:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/react:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/react-router:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/shared:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/tanstack-react-start:*:*:*:*:*:node.js:*:*
cpe:2.3:a:clerk:clerk\/vue:*:*:*:*:*:node.js:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-w24r-5266-9c3c

Published

@clerk/shared

npm

SEMVER · introduced 3.0.0 → fixed 3.47.5

@clerk/shared

npm

SEMVER · introduced 4.0.0 → fixed 4.8.3

@clerk/backend

npm

SEMVER · introduced 2.0.0 → fixed 2.33.3

@clerk/backend

npm

SEMVER · introduced 3.0.0 → fixed 3.2.14

@clerk/nextjs

npm

SEMVER · introduced 6.0.0 → fixed 6.39.3

@clerk/nextjs

npm

SEMVER · introduced 7.0.0 → fixed 7.2.4

@clerk/clerk-js

npm

SEMVER · introduced 5.22.0 → fixed 5.125.10

@clerk/clerk-js

npm

SEMVER · introduced 6.0.0 → fixed 6.7.5

@clerk/clerk-react

npm

SEMVER · introduced 5.9.0 → fixed 5.61.6

@clerk/react

npm

SEMVER · introduced 6.0.0 → fixed 6.4.3

@clerk/vue

npm

SEMVER · introduced 1.0.0 → fixed 1.17.21

@clerk/vue

npm

SEMVER · introduced 2.0.0 → fixed 2.0.16

@clerk/astro

npm

SEMVER · introduced 2.0.0 → fixed 2.17.11

@clerk/astro

npm

SEMVER · introduced 3.0.0 → fixed 3.0.18

@clerk/nuxt

npm

SEMVER · introduced 1.0.0 → fixed 1.13.29

@clerk/nuxt

npm

SEMVER · introduced 2.0.0 → fixed 2.2.5

@clerk/clerk-expo

npm

SEMVER · introduced 2.2.11 → fixed 2.19.36

@clerk/expo

npm

SEMVER · introduced 3.0.0 → fixed 3.2.2

@clerk/react-router

npm

SEMVER · introduced 0.0.1 → fixed 2.4.13

@clerk/react-router

npm

SEMVER · introduced 3.0.0 → fixed 3.1.4

@clerk/tanstack-react-start

npm

SEMVER · introduced 0.0.1 → fixed 0.29.11

@clerk/tanstack-react-start

npm

SEMVER · introduced 1.0.0 → fixed 1.1.4

@clerk/chrome-extension

npm

SEMVER · introduced 1.3.5 → fixed 2.9.15

@clerk/chrome-extension

npm

SEMVER · introduced 3.0.0 → fixed 3.1.15

@clerk/fastify

npm

SEMVER · introduced 1.0.42 → fixed 2.6.31

@clerk/fastify

npm

SEMVER · introduced 3.0.0 → fixed 3.1.16

@clerk/express

npm

SEMVER · introduced 0.1.0 → fixed 1.7.79

@clerk/express

npm

SEMVER · introduced 2.0.0 → fixed 2.1.6

@clerk/hono

npm

SEMVER · introduced 0.0.2 → fixed 0.1.16

Original source record · Cite this exact observation · Complete original publisher JSON