npm/@clerk/backend CVE-2026-34076: high 7.4, EPSS 0.40%

Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

Action: Upgrade @clerk/backend to 3.2.3 or later.

npm i @clerk/backend@3.2.3

Affected

Fixed versions

Sources

• osv: GHSA-gjxx-92w9-8v8f
• https://github.com/clerk/javascript/security/advisories/GHSA-gjxx-92w9-8v8f
• https://nvd.nist.gov/vuln/detail/CVE-2026-34076
• https://github.com/clerk/javascript

CVE-2026-34076 · published 2026-03-27T19:58:19Z · modified 2026-04-06T17:04:07.972168Z · JSON