CVE-2026-42349 Details
Description
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
A vulnerability exists in Clerk JavaScript authentication that allows authorization predicates to incorrectly return true for certain combined checks. This issue is present in multiple framework SDKs, including @clerk/shared, @clerk/nextjs, @clerk/backend, and others. The vulnerability arises when a has() or auth.protect() call combines reverification checks with roles, permissions, features, or plans, or when billing checks are mixed with role or permission checks. As a result, a user may be able to perform actions without meeting all the required conditions. However, this bypass does not compromise user sessions or authentication states.
Upgrade to the latest patch release of the affected framework package. If @clerk/clerk-js is pinned directly, upgrade to the patched version. Most applications will receive the fix automatically from Clerk's CDN through their framework package.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c | CISA-ADP | MitigationVendor Advisory |
| https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| clerk clerk/astro | >= 2.0.0, < 2.17.11 >= 3.0.0, < 3.0.18 |
CPE
Remediation
| |
| clerk clerk/backend | >= 2.0.0, < 2.33.3 >= 3.0.0, < 3.2.14 |
CPE
Remediation
| |
| clerk clerk/chrome-extension | >= 1.3.5, < 2.9.15 >= 3.0.0, < 3.1.15 |
CPE
Remediation
| |
| clerk clerk/clerk-expo | >= 2.2.11, < 2.19.36 |
CPE
Remediation
| |
| clerk clerk/clerk-js | >= 5.22.0, < 5.125.10 >= 6.0.0, < 6.7.5 |
CPE
Remediation
| |
| clerk clerk/clerk-react | >= 5.9.0, < 5.61.6 |
CPE
Remediation
| |
| clerk clerk/expo | >= 3.0.0, < 3.2.2 |
CPE
Remediation
| |
| clerk clerk/express | >= 0.1.0, < 1.7.79 >= 2.0.0, < 2.1.6 |
CPE
Remediation
| |
| clerk clerk/fastify | >= 1.0.42, < 2.6.31 >= 3.0.0, < 3.1.16 |
CPE
Remediation
| |
| clerk clerk/hono | >= 0.0.2, < 0.1.16 |
CPE
Remediation
| |
| clerk clerk/nextjs | >= 6.0.0, <= 6.39.3 >= 7.0.0, < 7.2.4 |
CPE
Remediation
| |
| clerk clerk/nuxt | >= 1.0.0, < 1.13.29 >= 2.0.0, < 2.2.5 |
CPE
Remediation
| |
| clerk clerk/react | >= 6.0.0, < 6.4.3 |
CPE
Remediation
| |
| clerk clerk/react-router | >= 0.0.1, < 2.4.13 >= 3.0.0, < 3.1.4 |
CPE
Remediation
| |
| clerk clerk/shared | >= 3.0.0, < 3.47.5 >= 4.0.0, < 4.8.3 |
CPE
Remediation
| |
| clerk clerk/tanstack-react-start | >= 0.0.1, < 0.29.11 >= 1.0.0, < 1.1.4 |
CPE
Remediation
| |
| clerk clerk/vue | >= 1.0.0, < 1.17.21 >= 2.0.0, < 2.0.16 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |