Cloudanix VulnDB

CVE-2026-42349

High · 8.1

CVSS

8.1

EPSS

0.4%

Published

May 11, 2026

CISA due date

—

The record

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.

Affected packages

Ecosystem Package Introduced Fixed
npm @clerk/astro 2.0.0 2.17.11
npm @clerk/astro 3.0.0 3.0.18
npm @clerk/backend 2.0.0 2.33.3
npm @clerk/backend 3.0.0 3.2.14
npm @clerk/chrome-extension 1.3.5 2.9.15
npm @clerk/chrome-extension 3.0.0 3.1.15
npm @clerk/clerk-expo 2.2.11 2.19.36
npm @clerk/clerk-js 5.22.0 5.125.10
npm @clerk/clerk-js 6.0.0 6.7.5
npm @clerk/clerk-react 5.9.0 5.61.6
npm @clerk/expo 3.0.0 3.2.2
npm @clerk/express 0.1.0 1.7.79
npm @clerk/express 2.0.0 2.1.6
npm @clerk/fastify 1.0.42 2.6.31
npm @clerk/fastify 3.0.0 3.1.16
npm @clerk/hono 0.0.2 0.1.16
npm @clerk/nextjs 6.0.0 6.39.3
npm @clerk/nextjs 7.0.0 7.2.4
npm @clerk/nuxt 1.0.0 1.13.29
npm @clerk/nuxt 2.0.0 2.2.5
npm @clerk/react 6.0.0 6.4.3
npm @clerk/react-router 0.0.1 2.4.13
npm @clerk/react-router 3.0.0 3.1.4
npm @clerk/shared 3.0.0 3.47.5
npm @clerk/shared 4.0.0 4.8.3
npm @clerk/tanstack-react-start 0.0.1 0.29.11
npm @clerk/tanstack-react-start 1.0.0 1.1.4
npm @clerk/vue 1.0.0 1.17.21
npm @clerk/vue 2.0.0 2.0.16

Related vulnerabilities