CVE-2026-42349

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions. This call shape can be bypassed if certain conditions are met: a has() or auth.protect() call that combines a reverification check with any of role, permission, feature, or plan, or that combines a billing check (feature or plan) with a role or permission check. This vulnerability is fixed in @clerk/clerk-js 5.125.10 and 6.7.5.

• clerk clerk\/astro (>= 2.0.0 < 2.17.11) • clerk clerk\/astro (>= 3.0.0 < 3.0.18) • clerk clerk\/backend (>= 2.0.0 < 2.33.3) • clerk clerk\/backend (>= 3.0.0 < 3.2.14) • clerk clerk\/chrome-extension (>= 1.3.5 < 2.9.15) • clerk clerk\/chrome-extension (>= 3.0.0 < 3.1.15) • clerk clerk\/clerk-expo (>= 2.2.11 < 2.19.36) • clerk clerk\/clerk-js (>= 5.22.0 < 5.125.10) • clerk clerk\/clerk-js (>= 6.0.0 < 6.7.5) • clerk clerk\/clerk-react (>= 5.9.0 < 5.61.6) • clerk clerk\/expo (>= 3.0.0 < 3.2.2) • clerk clerk\/express (>= 0.1.0 < 1.7.79) • clerk clerk\/express (>= 2.0.0 < 2.1.6) • clerk clerk\/fastify (>= 1.0.42 < 2.6.31) • clerk clerk\/fastify (>= 3.0.0 < 3.1.16) • clerk clerk\/hono (>= 0.0.2 < 0.1.16) • clerk clerk\/nextjs (>= 6.0.0 <= 6.39.3) • clerk clerk\/nextjs (>= 7.0.0 < 7.2.4) • clerk clerk\/nuxt (>= 1.0.0 < 1.13.29) • clerk clerk\/nuxt (>= 2.0.0 < 2.2.5) • clerk clerk\/react (>= 6.0.0 < 6.4.3) • clerk clerk\/react-router (>= 0.0.1 < 2.4.13) • clerk clerk\/react-router (>= 3.0.0 < 3.1.4) • clerk clerk\/shared (>= 3.0.0 < 3.47.5) • clerk clerk\/shared (>= 4.0.0 < 4.8.3) • clerk clerk\/tanstack-react-start (>= 0.0.1 < 0.29.11) • clerk clerk\/tanstack-react-start (>= 1.0.0 < 1.1.4) • clerk clerk\/vue (>= 1.0.0 < 1.17.21) • clerk clerk\/vue (>= 2.0.0 < 2.0.16)