CVE-2026-42349: Clerk Clerk/astro

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.

Affected products

  • Clerk Clerk/astro: from 2.0.0, before 2.17.11 (fixed in 2.17.11); from 3.0.0, before 3.0.18 (fixed in 3.0.18)
  • Clerk Clerk/backend: from 2.0.0, before 2.33.3 (fixed in 2.33.3); from 3.0.0, before 3.2.14 (fixed in 3.2.14)
  • Clerk Clerk/chrome-Extension: from 1.3.5, before 2.9.15 (fixed in 2.9.15); from 3.0.0, before 3.1.15 (fixed in 3.1.15)
  • Clerk Clerk/clerk-Expo: from 2.2.11, before 2.19.36 (fixed in 2.19.36)
  • Clerk Clerk/clerk-Js: from 5.22.0, before 5.125.10 (fixed in 5.125.10); from 6.0.0, before 6.7.5 (fixed in 6.7.5)
  • Clerk Clerk/clerk-React: from 5.9.0, before 5.61.6 (fixed in 5.61.6)
  • Clerk Clerk/expo: from 3.0.0, before 3.2.2 (fixed in 3.2.2)
  • Clerk Clerk/express: from 0.1.0, before 1.7.79 (fixed in 1.7.79); from 2.0.0, before 2.1.6 (fixed in 2.1.6)
  • Clerk Clerk/fastify: from 1.0.42, before 2.6.31 (fixed in 2.6.31); from 3.0.0, before 3.1.16 (fixed in 3.1.16)
  • Clerk Clerk/hono: from 0.0.2, before 0.1.16 (fixed in 0.1.16)
  • Clerk Clerk/nextjs: from 6.0.0, up to and including 6.39.3; from 7.0.0, before 7.2.4 (fixed in 7.2.4)
  • Clerk Clerk/nuxt: from 1.0.0, before 1.13.29 (fixed in 1.13.29); from 2.0.0, before 2.2.5 (fixed in 2.2.5)
  • Clerk Clerk/react: from 6.0.0, before 6.4.3 (fixed in 6.4.3)
  • Clerk Clerk/react-Router: from 0.0.1, before 2.4.13 (fixed in 2.4.13); from 3.0.0, before 3.1.4 (fixed in 3.1.4)
  • Clerk Clerk/shared: from 3.0.0, before 3.47.5 (fixed in 3.47.5); from 4.0.0, before 4.8.3 (fixed in 4.8.3)
  • Clerk Clerk/tanstack-React-Start: from 0.0.1, before 0.29.11 (fixed in 0.29.11); from 1.0.0, before 1.1.4 (fixed in 1.1.4)
  • Clerk Clerk/vue: from 1.0.0, before 1.17.21 (fixed in 1.17.21); from 2.0.0, before 2.0.16 (fixed in 2.0.16)

Published 2026-05-11. Last modified 2026-06-17.