CVE-2026-42349

17 advisories.

npm/@clerk/shared CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/shared to 3.47.5 or later.

npm i @clerk/shared@3.47.5

npm i @clerk/shared@4.8.3

Affected

introduced	fixed	last affected
3.0.0	3.47.5	-
4.0.0	4.8.3	-

Fixed versions

3.47.5

4.8.3

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/backend CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/backend to 2.33.3 or later.

npm i @clerk/backend@2.33.3

npm i @clerk/backend@3.2.14

Affected

introduced	fixed	last affected
2.0.0	2.33.3	-
3.0.0	3.2.14	-

Fixed versions

2.33.3

3.2.14

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/nextjs CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/nextjs to 6.39.3 or later.

npm i @clerk/nextjs@6.39.3

npm i @clerk/nextjs@7.2.4

Affected

introduced	fixed	last affected
6.0.0	6.39.3	-
7.0.0	7.2.4	-

Fixed versions

6.39.3

7.2.4

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/clerk-js CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/clerk-js to 5.125.10 or later.

npm i @clerk/clerk-js@5.125.10

npm i @clerk/clerk-js@6.7.5

Affected

introduced	fixed	last affected
5.22.0	5.125.10	-
6.0.0	6.7.5	-

Fixed versions

5.125.10

6.7.5

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/clerk-react CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/clerk-react to 5.61.6 or later.

npm i @clerk/clerk-react@5.61.6

Affected

introduced	fixed	last affected
5.9.0	5.61.6	-

Fixed versions

5.61.6

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/react CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/react to 6.4.3 or later.

npm i @clerk/react@6.4.3

Affected

introduced	fixed	last affected
6.0.0	6.4.3	-

Fixed versions

6.4.3

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/vue CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/vue to 1.17.21 or later.

npm i @clerk/vue@1.17.21

npm i @clerk/vue@2.0.16

Affected

introduced	fixed	last affected
1.0.0	1.17.21	-
2.0.0	2.0.16	-

Fixed versions

1.17.21

2.0.16

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/astro CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/astro to 2.17.11 or later.

npm i @clerk/astro@2.17.11

npm i @clerk/astro@3.0.18

Affected

introduced	fixed	last affected
2.0.0	2.17.11	-
3.0.0	3.0.18	-

Fixed versions

2.17.11

3.0.18

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/nuxt CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/nuxt to 1.13.29 or later.

npm i @clerk/nuxt@1.13.29

npm i @clerk/nuxt@2.2.5

Affected

introduced	fixed	last affected
1.0.0	1.13.29	-
2.0.0	2.2.5	-

Fixed versions

1.13.29

2.2.5

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/clerk-expo CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/clerk-expo to 2.19.36 or later.

npm i @clerk/clerk-expo@2.19.36

Affected

introduced	fixed	last affected
2.2.11	2.19.36	-

Fixed versions

2.19.36

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/expo CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/expo to 3.2.2 or later.

npm i @clerk/expo@3.2.2

Affected

introduced	fixed	last affected
3.0.0	3.2.2	-

Fixed versions

3.2.2

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/react-router CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/react-router to 2.4.13 or later.

npm i @clerk/react-router@2.4.13

npm i @clerk/react-router@3.1.4

Affected

introduced	fixed	last affected
0.0.1	2.4.13	-
3.0.0	3.1.4	-

Fixed versions

2.4.13

3.1.4

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/tanstack-react-start CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/tanstack-react-start to 0.29.11 or later.

npm i @clerk/tanstack-react-start@0.29.11

npm i @clerk/tanstack-react-start@1.1.4

Affected

introduced	fixed	last affected
0.0.1	0.29.11	-
1.0.0	1.1.4	-

Fixed versions

0.29.11

1.1.4

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/chrome-extension CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/chrome-extension to 2.9.15 or later.

npm i @clerk/chrome-extension@2.9.15

npm i @clerk/chrome-extension@3.1.15

Affected

introduced	fixed	last affected
1.3.5	2.9.15	-
3.0.0	3.1.15	-

Fixed versions

2.9.15

3.1.15

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/fastify CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/fastify to 2.6.31 or later.

npm i @clerk/fastify@2.6.31

npm i @clerk/fastify@3.1.16

Affected

introduced	fixed	last affected
1.0.42	2.6.31	-
3.0.0	3.1.16	-

Fixed versions

2.6.31

3.1.16

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/express CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/express to 1.7.79 or later.

npm i @clerk/express@1.7.79

npm i @clerk/express@2.1.6

Affected

introduced	fixed	last affected
0.1.0	1.7.79	-
2.0.0	2.1.6	-

Fixed versions

1.7.79

2.1.6

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON

npm/@clerk/hono CVE-2026-42349: high 8.1

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Action: Upgrade @clerk/hono to 0.1.16 or later.

npm i @clerk/hono@0.1.16

Affected

introduced	fixed	last affected
0.0.2	0.1.16	-

Fixed versions

0.1.16

Sources

CVE-2026-42349 · published 2026-04-30T18:20:02Z · modified 2026-09-10T03:51:03.672253114Z · JSON