CVE-2026-42349
Full vulnerability record from the local CVENow database.
Description
Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.
Severity
HIGH
CVSS score
7.6
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-11 17:16:33.147000
Last modified
2026-10-26 18:10:00.173000
View original CVE JSON
{
"id": "CVE-2026-42349",
"sourceIdentifier": "[email protected]",
"published": "2026-05-11T17:16:33.147",
"lastModified": "2026-10-26T18:10:00.173",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5."
},
{
"lang": "es",
"value": "Clerk JavaScript es el repositorio oficial de JavaScript para la autenticación de Clerk. has(), auth.protect() y los predicados de autorización relacionados en @clerk/shared, @clerk/nextjs, @clerk/backend y otros SDK de framework pueden devolver true para ciertas comprobaciones de autorización combinadas cuando el resultado debería ser false, permitiendo que una acción restringida proceda para un usuario que no satisface el conjunto completo de condiciones solicitadas. Esta forma de llamada puede ser eludida si se cumplen ciertas condiciones: una llamada a has() o auth.protect() que combine una comprobación de reverificación con cualquiera de rol, permiso, característica o plan, o que combine una comprobación de facturación (característica o plan) con una comprobación de rol o permiso. Esta vulnerabilidad está corregida en @clerk/clerk-js 5.125.10 y 6.7.5."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "clerk",
"product": "javascript",
"versions": [
{
"version": ">= 5.22.0, < 5.125.10",
"status": "affected"
},
{
"version": ">= 6.0.0, < 6.7.5",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "shared",
"versions": [
{
"version": ">= 3.0.0, <= 3.47.4",
"status": "affected"
},
{
"version": ">= 4.0.0, <= 4.8.2",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "backend",
"versions": [
{
"version": ">= 2.0.0, <= 2.33.2",
"status": "affected"
},
{
"version": ">= 3.0.0, <= 3.2.13",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "nextjs",
"versions": [
{
"version": ">= 6.0.0, <= 6.39.2",
"status": "affected"
},
{
"version": ">= 7.0.0, <= 7.2.3",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "clerk-react",
"versions": [
{
"version": ">= 5.9.0, <= 5.61.5",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "react",
"versions": [
{
"version": ">= 6.0.0, <= 6.4.2",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "vue",
"versions": [
{
"version": ">= 1.0.0, <= 1.17.20",
"status": "affected"
},
{
"version": ">= 2.0.0, <= 2.0.15",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "astro",
"versions": [
{
"version": ">= 2.0.0, <= 2.17.10",
"status": "affected"
},
{
"version": ">= 3.0.0, <= 3.0.17",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "nuxt",
"versions": [
{
"version": ">= 1.0.0, <= 1.13.28",
"status": "affected"
},
{
"version": ">= 2.0.0, <= 2.2.4",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "clerk-expo",
"versions": [
{
"version": ">= 2.2.11, <= 2.19.35",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "expo",
"versions": [
{
"version": ">= 3.0.0, <= 3.2.1",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "react-router",
"versions": [
{
"version": ">= 0.0.1, <= 2.4.12",
"status": "affected"
},
{
"version": ">= 3.0.0, <= 3.1.3",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "tanstack-react-start",
"versions": [
{
"version": ">= 0.0.1, <= 0.29.10",
"status": "affected"
},
{
"version": ">= 1.0.0, <= 1.1.3",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "chrome-extension",
"versions": [
{
"version": ">= 1.3.5, <= 2.9.14",
"status": "affected"
},
{
"version": ">= 3.0.0, <= 3.1.14",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "fastify",
"versions": [
{
"version": ">= 1.0.42, <= 2.6.30",
"status": "affected"
},
{
"version": ">= 3.0.0, <= 3.1.15",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "express",
"versions": [
{
"version": ">= 0.1.0, <= 1.7.78",
"status": "affected"
},
{
"version": ">= 2.0.0, <= 2.1.5",
"status": "affected"
}
]
},
{
"vendor": "@clerk",
"product": "hono",
"versions": [
{
"version": ">= 0.0.2, <= 0.1.15",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-14T18:18:41.752602Z",
"id": "CVE-2026-42349",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-754"
},
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/astro:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.17.11",
"matchCriteriaId": "30F84DDC-8228-4D7A-BEAC-FDE0487D41DB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/astro:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "3.0.0",
"versionEndExcluding": "3.0.18",
"matchCriteriaId": "92B175FF-5976-481F-9FC3-52C00392997C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/backend:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.33.3",
"matchCriteriaId": "42CE4C47-A64E-47F5-8FF2-2855F623CB3E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/backend:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "3.0.0",
"versionEndExcluding": "3.2.14",
"matchCriteriaId": "92B0F10A-B9D0-4AE7-ACE0-DF80D552BB9C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/chrome-extension:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "1.3.5",
"versionEndExcluding": "2.9.15",
"matchCriteriaId": "AD1020C4-8984-48C5-B0BA-3402BC536594"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/chrome-extension:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "3.0.0",
"versionEndExcluding": "3.1.15",
"matchCriteriaId": "93FD23D3-85FC-4D5A-A3EA-8B7407CC61CA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/clerk-expo:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "2.2.11",
"versionEndExcluding": "2.19.36",
"matchCriteriaId": "24002AC3-72F0-47F4-A707-175A69CD5ECB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/clerk-js:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "5.22.0",
"versionEndExcluding": "5.125.10",
"matchCriteriaId": "38BB715E-E178-45DE-B9C2-8EF360B1A9BF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/clerk-js:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "6.0.0",
"versionEndExcluding": "6.7.5",
"matchCriteriaId": "D69C1684-8259-418D-8030-9BA5ED83DC69"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/clerk-react:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "5.9.0",
"versionEndExcluding": "5.61.6",
"matchCriteriaId": "9F3D0D75-CD5E-4F80-ADD5-36BEA19187EB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/expo:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "3.0.0",
"versionEndExcluding": "3.2.2",
"matchCriteriaId": "114A7068-CDA7-4294-8EC1-A4A38E06179D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/express:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "0.1.0",
"versionEndExcluding": "1.7.79",
"matchCriteriaId": "1D670F00-A86F-4157-AACE-2FB37F1D2E74"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/express:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.1.6",
"matchCriteriaId": "5EB164E5-717B-4611-8DFF-517137745E1A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/fastify:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "1.0.42",
"versionEndExcluding": "2.6.31",
"matchCriteriaId": "194D3D4A-19B4-42C2-B119-35F67CEC0AFD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/fastify:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "3.0.0",
"versionEndExcluding": "3.1.16",
"matchCriteriaId": "636525D8-19DC-47DA-AFE3-58CA0CC5E4E4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/hono:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "0.0.2",
"versionEndExcluding": "0.1.16",
"matchCriteriaId": "9C6F5918-2B3F-4544-9C3E-2D02D147D803"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/nextjs:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "6.0.0",
"versionEndIncluding": "6.39.3",
"matchCriteriaId": "209A417F-36BB-48E0-A594-17A3D8E452E1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/nextjs:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "7.0.0",
"versionEndExcluding": "7.2.4",
"matchCriteriaId": "6348D1BD-DD97-42E0-A121-4F58DC2BE4DC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/nuxt:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "1.0.0",
"versionEndExcluding": "1.13.29",
"matchCriteriaId": "8D6A7B72-1686-4B16-ABB3-6594D926611C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/nuxt:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.2.5",
"matchCriteriaId": "F5706271-25D7-4F57-A620-FD2310DB8CB2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/react:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "6.0.0",
"versionEndExcluding": "6.4.3",
"matchCriteriaId": "3ADF13F3-1C39-4766-A0DD-BC40381D306B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/react-router:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "0.0.1",
"versionEndExcluding": "2.4.13",
"matchCriteriaId": "6FD1A00D-D69F-43C8-8055-60C8DA68C97A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/react-router:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "3.0.0",
"versionEndExcluding": "3.1.4",
"matchCriteriaId": "4657521F-E4B7-4F7F-83AB-02B1E4F865D6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/shared:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "3.0.0",
"versionEndExcluding": "3.47.5",
"matchCriteriaId": "4A4C4196-ACCC-4115-800F-D4CC704B2DBE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/shared:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "4.0.0",
"versionEndExcluding": "4.8.3",
"matchCriteriaId": "3F3189BA-BCCB-453A-BB4E-72B14E9CB6CA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/tanstack-react-start:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "0.0.1",
"versionEndExcluding": "0.29.11",
"matchCriteriaId": "091BA1A0-5062-4B26-A829-FC9A6D38929D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/tanstack-react-start:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "1.0.0",
"versionEndExcluding": "1.1.4",
"matchCriteriaId": "D7971F38-FE69-4A83-9DB8-803FCF3CBAE5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/vue:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "1.0.0",
"versionEndExcluding": "1.17.21",
"matchCriteriaId": "6AC18FE5-605B-4753-8F15-BD67BF67E8C2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:clerk:clerk\\/vue:*:*:*:*:*:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.0.16",
"matchCriteriaId": "CA0368CF-A074-45E5-889E-A346F96D7A26"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c",
"source": "[email protected]",
"tags": [
"Mitigation",
"Vendor Advisory"
]
},
{
"url": "https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Mitigation",
"Vendor Advisory"
]
}
]
}