CVE catalog
CVE-2026-42349
Clerk JavaScript is the official JavaScript repository…
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
- Severity
- High · CVSS 7.6
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.25% · Oct 27, 2026
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "clerk\\/astro",
"ecosystem": "cpe",
"fixed_version": "2.17.11"
},
{
"name": "clerk\\/astro",
"ecosystem": "cpe",
"fixed_version": "3.0.18"
},
{
"name": "clerk\\/backend",
"ecosystem": "cpe",
"fixed_version": "2.33.3"
},
{
"name": "clerk\\/backend",
"ecosystem": "cpe",
"fixed_version": "3.2.14"
},
{
"name": "clerk\\/chrome-extension",
"ecosystem": "cpe",
"fixed_version": "2.9.15"
},
{
"name": "clerk\\/chrome-extension",
"ecosystem": "cpe",
"fixed_version": "3.1.15"
},
{
"name": "clerk\\/clerk-expo",
"ecosystem": "cpe",
"fixed_version": "2.19.36"
},
{
"name": "clerk\\/clerk-js",
"ecosystem": "cpe",
"fixed_version": "5.125.10"
},
{
"name": "clerk\\/clerk-js",
"ecosystem": "cpe",
"fixed_version": "6.7.5"
},
{
"name": "clerk\\/clerk-react",
"ecosystem": "cpe",
"fixed_version": "5.61.6"
},
{
"name": "clerk\\/expo",
"ecosystem": "cpe",
"fixed_version": "3.2.2"
},
{
"name": "clerk\\/express",
"ecosystem": "cpe",
"fixed_version": "1.7.79"
},
{
"name": "clerk\\/express",
"ecosystem": "cpe",
"fixed_version": "2.1.6"
},
{
"name": "clerk\\/fastify",
"ecosystem": "cpe",
"fixed_version": "2.6.31"
},
{
"name": "clerk\\/fastify",
"ecosystem": "cpe",
"fixed_version": "3.1.16"
},
{
"name": "clerk\\/hono",
"ecosystem": "cpe",
"fixed_version": "0.1.16"
},
{
"name": "clerk\\/nextjs",
"ecosystem": "cpe",
"fixed_version": ""
},
{
"name": "clerk\\/nextjs",
"ecosystem": "cpe",
"fixed_version": "7.2.4"
},
{
"name": "clerk\\/nuxt",
"ecosystem": "cpe",
"fixed_version": "1.13.29"
},
{
"name": "clerk\\/nuxt",
"ecosystem": "cpe",
"fixed_version": "2.2.5"
},
{
"name": "clerk\\/astro",
"ranges": [
{
"fixed": "3.0.18",
"introduced": "3.0.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "3.0.18",
"provider_record_id": "NVD-CVE-2026-42349"
},
{
"name": "clerk\\/backend",
"ranges": [
{
"fixed": "3.2.14",
"introduced": "3.0.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "3.2.14",
"provider_record_id": "NVD-CVE-2026-42349"
},
{
"name": "clerk\\/chrome-extension",
"ranges": [
{
"fixed": "3.1.15",
"introduced": "3.0.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "3.1.15",
"provider_record_id": "NVD-CVE-2026-42349"
},
{
"name": "clerk\\/clerk-expo",
"ranges": [
{
"fixed": "2.19.36",
"introduced": "2.2.11",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "2.19.36",
"provider_record_id": "NVD-CVE-2026-42349"
},
{
"name": "clerk\\/clerk-js",
"ranges": [
{
"fixed": "6.7.5",
"introduced": "6.0.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "6.7.5",
"provider_record_id": "NVD-CVE-2026-42349"
},
{
"name": "clerk\\/clerk-react",
"ranges": [
{
"fixed": "5.61.6",
"introduced": "5.9.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "5.61.6",
"provider_record_id": "NVD-CVE-2026-42349"
},
{
"name": "clerk\\/expo",
"ranges": [
{
"fixed": "3.2.2",
"introduced": "3.0.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "3.2.2",
"provider_record_id": "NVD-CVE-2026-42349"
},
{
"name": "clerk\\/express",
"ranges": [
{
"fixed": "2.1.6",
"introduced": "2.0.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "2.1.6",
"provider_record_id": "NVD-CVE-2026-42349"
},
{
"name": "clerk\\/fastify",
"ranges": [
{
"fixed": "3.1.16",
"introduced": "3.0.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "3.1.16",
"provider_record_id": "NVD-CVE-2026-42349"
},
{
"name": "clerk\\/hono",
"ranges": [
{
"fixed": "0.1.16",
"introduced": "0.0.2",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "0.1.16",
"provider_record_id": "NVD-CVE-2026-42349"
},
{
"name": "clerk\\/nextjs",
"ranges": [
{
"fixed": "7.2.4",
"introduced": "7.0.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "7.2.4",
"provider_record_id": "NVD-CVE-2026-42349"
},
{
"name": "clerk\\/nuxt",
"ranges": [
{
"fixed": "2.2.5",
"introduced": "2.0.0",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "2.2.5",
"provider_record_id": "NVD-CVE-2026-42349"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
Observed: