What’s Vulnerable › Products

clerk javascript vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your clerk javascript version is affected

Latest clerk javascript vulnerabilities

• CVE-2026-34076 — Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host (CVSS 7.4)
• CVE-2025-53548 — @clerk/backend Performs Insufficient Verification of Data Authenticity (CVSS 7.5)
• CVE-2024-22206 — @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) (CVSS 9.8)