Quick answers
- Is CVE-2025-53548 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-53548 being exploited in the wild.
- How severe is CVE-2025-53548?
- Low severity, with a CVSS score of 3.1, published 9 July 2025.
- Which products and versions are affected?
- @clerk/astro (npm) SEMVER:introduced=2.9.0,fixed=2.10.2; @clerk/backend (npm) SEMVER:introduced=2.0.0,fixed=2.4.0; @clerk/express (npm) SEMVER:introduced=1.6.0,fixed=1.7.4; @clerk/fastify (npm) SEMVER:introduced=2.3.0,fixed=2.4.4; and 5 more.
- Is there a fix for CVE-2025-53548?
- Yes. @clerk/astro (npm): upgrade to 2.10.2 or later; @clerk/backend (npm): upgrade to 2.4.0 or later; @clerk/express (npm): upgrade to 1.7.4 or later; @clerk/fastify (npm): upgrade to 2.4.4 or later; @clerk/nextjs (npm): upgrade to 6.23.3 or later; @clerk/nuxt (npm): upgrade to 1.7.5 or later; @clerk/react-router (npm): upgrade to 1.6.4 or later; @clerk/remix (npm): upgrade to 4.8.5 or later; @clerk/tanstack-react-start (npm): upgrade to 0.18.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-53548 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-53548?
- Check whether you run @clerk/astro (npm), @clerk/backend (npm), @clerk/express (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @clerk/astro (npm): upgrade to 2.10.2 or later
npm install @clerk/astro@2.10.2 - @clerk/backend (npm): upgrade to 2.4.0 or later
npm install @clerk/backend@2.4.0 - @clerk/express (npm): upgrade to 1.7.4 or later
npm install @clerk/express@1.7.4 - @clerk/fastify (npm): upgrade to 2.4.4 or later
npm install @clerk/fastify@2.4.4 - @clerk/nextjs (npm): upgrade to 6.23.3 or later
npm install @clerk/nextjs@6.23.3 - @clerk/nuxt (npm): upgrade to 1.7.5 or later
npm install @clerk/nuxt@1.7.5 - @clerk/react-router (npm): upgrade to 1.6.4 or later
npm install @clerk/react-router@1.6.4 - @clerk/remix (npm): upgrade to 4.8.5 or later
npm install @clerk/remix@4.8.5 - @clerk/tanstack-react-start (npm): upgrade to 0.18.3 or later
npm install @clerk/tanstack-react-start@0.18.3
Technical details
The verifyWebhook() helper in multiple Clerk SDKs (backend, nextjs, remix, express, fastify, nuxt, astro, react-router, tanstack-react-start) failed to properly parse and validate webhook request signatures. The vulnerability is rooted in CWE-345 (Insufficient Verification of Data Authenticity): the helper did not correctly compare received signatures against the expected HMAC signature derived from the webhook payload. An unauthenticated, network-accessible attacker can send forged webhook events to applications without providing a valid signature. The fix (implemented in @clerk/backend 2.4.0 and corresponding versions in dependent packages) corrects signature parsing and comparison logic. No user interaction is required; exploitation occurs during normal webhook processing.
Affected products
- Clerk @clerk/backend 2.0.0 to 2.3.x
- Clerk @clerk/nextjs 6.2.10 to 6.23.2
- Clerk @clerk/remix 4.8.0 to 4.8.4
- Clerk @clerk/express 1.6.0 to 1.7.3
- Clerk @clerk/fastify 2.3.0 to 2.4.3
- Clerk @clerk/nuxt 1.7.0 to 1.7.4
- Clerk @clerk/astro 2.9.0 to 2.10.1
- Clerk @clerk/react-router 1.5.0 to 1.6.3
- Clerk @clerk/tanstack-react-start 0.16.0 to 0.18.2
Identifiers
- CVE-2025-53548
- GHSA-9mp4-77wg-rwx9
Timeline
- 2025-07-09: disclosed: Vulnerability published in GHSA and CVE databases
- 2025-07-09: patched: Patches released across all affected Clerk packages