UpHeron
All vulnerabilities

npm

CVE-2026-42349

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Severity
High 8.1
Published
30 Apr 2026
Last changed
10 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
5.61.6, 5.125.10, 6.4.3, 6.7.5, 6.39.3, 7.2.4
Also known as
GHSA-w24r-5266-9c3c
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
@clerk/astronpm · osv:npm:@clerk/astro
  • From 2.0.0 before 2.17.11
  • From 3.0.0 before 3.0.18
@clerk/backendnpm · osv:npm:@clerk/backend
  • From 2.0.0 before 2.33.3
  • From 3.0.0 before 3.2.14
@clerk/chrome-extensionnpm · osv:npm:@clerk/chrome-extension
  • From 1.3.5 before 2.9.15
  • From 3.0.0 before 3.1.15
@clerk/clerk-exponpm · osv:npm:@clerk/clerk-expo
  • From 2.2.11 before 2.19.36
@clerk/clerk-jsnpm · osv:npm:@clerk/clerk-js
  • From 5.22.0 before 5.125.10
  • From 6.0.0 before 6.7.5
@clerk/clerk-reactnpm · osv:npm:@clerk/clerk-react
  • From 5.9.0 before 5.61.6
@clerk/exponpm · osv:npm:@clerk/expo
  • From 3.0.0 before 3.2.2
@clerk/expressnpm · osv:npm:@clerk/express
  • From 0.1.0 before 1.7.79
  • From 2.0.0 before 2.1.6
@clerk/fastifynpm · osv:npm:@clerk/fastify
  • From 1.0.42 before 2.6.31
  • From 3.0.0 before 3.1.16
@clerk/hononpm · osv:npm:@clerk/hono
  • From 0.0.2 before 0.1.16
@clerk/nextjsnpm · osv:npm:@clerk/nextjs
  • From 6.0.0 before 6.39.3
  • From 7.0.0 before 7.2.4
@clerk/nuxtnpm · osv:npm:@clerk/nuxt
  • From 1.0.0 before 1.13.29
  • From 2.0.0 before 2.2.5
@clerk/reactnpm · osv:npm:@clerk/react
  • From 6.0.0 before 6.4.3
@clerk/react-routernpm · osv:npm:@clerk/react-router
  • From 0.0.1 before 2.4.13
  • From 3.0.0 before 3.1.4
@clerk/sharednpm · osv:npm:@clerk/shared
  • From 3.0.0 before 3.47.5
  • From 4.0.0 before 4.8.3
@clerk/tanstack-react-startnpm · osv:npm:@clerk/tanstack-react-start
  • From 0.0.1 before 0.29.11
  • From 1.0.0 before 1.1.4
@clerk/vuenpm · osv:npm:@clerk/vue
  • From 1.0.0 before 1.17.21
  • From 2.0.0 before 2.0.16

References