VIR Vulnerability Intelligence Relay

CVE-2026-42349

high
Published 2026-05-11 · Modified 2026-06-01
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4 NEW
7.6
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
VIR risk
8.1

Description

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.

Predictions

Exploit likelihood
88%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Package impact
EcosystemPackageVulnerableFixed
npm npm@clerk/shared>=3.0.0,<3.47.53.47.5
npm npm@clerk/shared>=4.0.0,<4.8.34.8.3
npm npm@clerk/backend>=2.0.0,<2.33.32.33.3
npm npm@clerk/backend>=3.0.0,<3.2.143.2.14
npm npm@clerk/nextjs>=6.0.0,<6.39.36.39.3
npm npm@clerk/nextjs>=7.0.0,<7.2.47.2.4
npm npm@clerk/clerk-js>=5.22.0,<5.125.105.125.10
npm npm@clerk/clerk-js>=6.0.0,<6.7.56.7.5
npm npm@clerk/clerk-react>=5.9.0,<5.61.65.61.6
npm npm@clerk/react>=6.0.0,<6.4.36.4.3
npm npm@clerk/vue>=1.0.0,<1.17.211.17.21
npm npm@clerk/vue>=2.0.0,<2.0.162.0.16
npm npm@clerk/astro>=2.0.0,<2.17.112.17.11
npm npm@clerk/astro>=3.0.0,<3.0.183.0.18
npm npm@clerk/nuxt>=1.0.0,<1.13.291.13.29
npm npm@clerk/nuxt>=2.0.0,<2.2.52.2.5
npm npm@clerk/clerk-expo>=2.2.11,<2.19.362.19.36
npm npm@clerk/expo>=3.0.0,<3.2.23.2.2
npm npm@clerk/react-router>=0.0.1,<2.4.132.4.13
npm npm@clerk/react-router>=3.0.0,<3.1.43.1.4
npm npm@clerk/tanstack-react-start>=0.0.1,<0.29.110.29.11
npm npm@clerk/tanstack-react-start>=1.0.0,<1.1.41.1.4
npm npm@clerk/chrome-extension>=1.3.5,<2.9.152.9.15
npm npm@clerk/chrome-extension>=3.0.0,<3.1.153.1.15
npm npm@clerk/fastify>=1.0.42,<2.6.312.6.31
npm npm@clerk/fastify>=3.0.0,<3.1.163.1.16
npm npm@clerk/express>=0.1.0,<1.7.791.7.79
npm npm@clerk/express>=2.0.0,<2.1.62.1.6
npm npm@clerk/hono>=0.0.2,<0.1.160.1.16
npm NPM@clerk/hono>= 0.0.2, <= 0.1.150.1.16
npm NPM@clerk/express>= 2.0.0, <= 2.1.52.1.6
npm NPM@clerk/express>= 0.1.0, <= 1.7.781.7.79
npm NPM@clerk/fastify>= 3.0.0, <= 3.1.153.1.16
npm NPM@clerk/fastify>= 1.0.42, <= 2.6.302.6.31
npm NPM@clerk/chrome-extension>= 3.0.0, <= 3.1.143.1.15
npm NPM@clerk/chrome-extension>= 1.3.5, <= 2.9.142.9.15
npm NPM@clerk/tanstack-react-start>= 1.0.0, <= 1.1.31.1.4
npm NPM@clerk/tanstack-react-start>= 0.0.1, <= 0.29.100.29.11
npm NPM@clerk/react-router>= 3.0.0, <= 3.1.33.1.4
npm NPM@clerk/react-router>= 0.0.1, <= 2.4.122.4.13
npm NPM@clerk/expo>= 3.0.0, <= 3.2.13.2.2
npm NPM@clerk/clerk-expo>= 2.2.11, <= 2.19.352.19.36
npm NPM@clerk/nuxt>= 2.0.0, <= 2.2.42.2.5
npm NPM@clerk/nuxt>= 1.0.0, <= 1.13.281.13.29
npm NPM@clerk/astro>= 3.0.0, <= 3.0.173.0.18
npm NPM@clerk/astro>= 2.0.0, <= 2.17.102.17.11
npm NPM@clerk/vue>= 2.0.0, <= 2.0.152.0.16
npm NPM@clerk/vue>= 1.0.0, <= 1.17.201.17.21
npm NPM@clerk/react>= 6.0.0, <= 6.4.26.4.3
npm NPM@clerk/clerk-react>= 5.9.0, <= 5.61.55.61.6
npm NPM@clerk/clerk-js>= 6.0.0, <= 6.7.46.7.5
npm NPM@clerk/clerk-js>= 5.22.0, <= 5.125.95.125.10
npm NPM@clerk/nextjs>= 7.0.0, <= 7.2.37.2.4
npm NPM@clerk/nextjs>= 6.0.0, <= 6.39.26.39.3
npm NPM@clerk/backend>= 3.0.0, <= 3.2.133.2.14
npm NPM@clerk/backend>= 2.0.0, <= 2.33.22.33.3
npm NPM@clerk/shared>= 4.0.0, <= 4.8.24.8.3
npm NPM@clerk/shared>= 3.0.0, <= 3.47.43.47.5

Application impact
VendorProductVersionsFixed
clerkclerk\/astro{"startIncluding":"2.0.0","endExcluding":"2.17.11"}2.17.11
clerkclerk\/astro{"startIncluding":"3.0.0","endExcluding":"3.0.18"}3.0.18
clerkclerk\/backend{"startIncluding":"2.0.0","endExcluding":"2.33.3"}2.33.3
clerkclerk\/backend{"startIncluding":"3.0.0","endExcluding":"3.2.14"}3.2.14
clerkclerk\/chrome-extension{"startIncluding":"1.3.5","endExcluding":"2.9.15"}2.9.15
clerkclerk\/chrome-extension{"startIncluding":"3.0.0","endExcluding":"3.1.15"}3.1.15
clerkclerk\/clerk-expo{"startIncluding":"2.2.11","endExcluding":"2.19.36"}2.19.36
clerkclerk\/clerk-js{"startIncluding":"5.22.0","endExcluding":"5.125.10"}5.125.10
clerkclerk\/clerk-js{"startIncluding":"6.0.0","endExcluding":"6.7.5"}6.7.5
clerkclerk\/clerk-react{"startIncluding":"5.9.0","endExcluding":"5.61.6"}5.61.6
clerkclerk\/expo{"startIncluding":"3.0.0","endExcluding":"3.2.2"}3.2.2
clerkclerk\/express{"startIncluding":"0.1.0","endExcluding":"1.7.79"}1.7.79
clerkclerk\/express{"startIncluding":"2.0.0","endExcluding":"2.1.6"}2.1.6
clerkclerk\/fastify{"startIncluding":"1.0.42","endExcluding":"2.6.31"}2.6.31
clerkclerk\/fastify{"startIncluding":"3.0.0","endExcluding":"3.1.16"}3.1.16
clerkclerk\/hono{"startIncluding":"0.0.2","endExcluding":"0.1.16"}0.1.16
clerkclerk\/nextjs{"startIncluding":"6.0.0","endIncluding":"6.39.3"}
clerkclerk\/nextjs{"startIncluding":"7.0.0","endExcluding":"7.2.4"}7.2.4
clerkclerk\/nuxt{"startIncluding":"1.0.0","endExcluding":"1.13.29"}1.13.29
clerkclerk\/nuxt{"startIncluding":"2.0.0","endExcluding":"2.2.5"}2.2.5
clerkclerk\/react{"startIncluding":"6.0.0","endExcluding":"6.4.3"}6.4.3
clerkclerk\/react-router{"startIncluding":"0.0.1","endExcluding":"2.4.13"}2.4.13
clerkclerk\/react-router{"startIncluding":"3.0.0","endExcluding":"3.1.4"}3.1.4
clerkclerk\/shared{"startIncluding":"3.0.0","endExcluding":"3.47.5"}3.47.5
clerkclerk\/shared{"startIncluding":"4.0.0","endExcluding":"4.8.3"}4.8.3
clerkclerk\/tanstack-react-start{"startIncluding":"0.0.1","endExcluding":"0.29.11"}0.29.11
clerkclerk\/tanstack-react-start{"startIncluding":"1.0.0","endExcluding":"1.1.4"}1.1.4
clerkclerk\/vue{"startIncluding":"1.0.0","endExcluding":"1.17.21"}1.17.21
clerkclerk\/vue{"startIncluding":"2.0.0","endExcluding":"2.0.16"}2.0.16

References

CWEs

CWE-754 CWE-863

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.