# CVE-2025-53548: Clerk webhook verifyWebhook insufficient signature verification Source: https://junglewise.ai/threats/cve-2025-53548-clerk-webhook-verifywebhook-insufficient-signature-verification Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2025-07-09. Updated: 2026-09-25 License: CC BY 4.0 with a link back CVE-2025-53548 · Severity: low · CVSS 3.1 · Published 2025-07-09 Clerk's webhook verification helper accepts improperly signed webhook events from the Clerk authentication service. An attacker can forge webhook messages (such as user creation, deletion, or session events) without a valid signature, enabling unauthorized account manipulation and session hijacking in applications relying on webhook events for security-critical decisions. Technologies: [@clerk/astro (npm)](https://junglewise.ai/threats/technologies/clerk-astro), [@clerk/backend (npm)](https://junglewise.ai/threats/technologies/clerk-backend), [@clerk/express (npm)](https://junglewise.ai/threats/technologies/clerk-express), [@clerk/fastify (npm)](https://junglewise.ai/threats/technologies/clerk-fastify), [@clerk/nextjs (npm)](https://junglewise.ai/threats/technologies/clerk-nextjs), [@clerk/nuxt (npm)](https://junglewise.ai/threats/technologies/clerk-nuxt). Vendors: [npm](https://junglewise.ai/threats/vendors/npm). ## Quick answers **Is CVE-2025-53548 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-53548 being exploited in the wild. **How severe is CVE-2025-53548?** Low severity, with a CVSS score of 3.1, published 9 July 2025. **Which products and versions are affected?** @clerk/astro (npm) SEMVER:introduced=2.9.0,fixed=2.10.2; @clerk/backend (npm) SEMVER:introduced=2.0.0,fixed=2.4.0; @clerk/express (npm) SEMVER:introduced=1.6.0,fixed=1.7.4; @clerk/fastify (npm) SEMVER:introduced=2.3.0,fixed=2.4.4; and 5 more. **Is there a fix for CVE-2025-53548?** Yes. @clerk/astro (npm): upgrade to 2.10.2 or later; @clerk/backend (npm): upgrade to 2.4.0 or later; @clerk/express (npm): upgrade to 1.7.4 or later; @clerk/fastify (npm): upgrade to 2.4.4 or later; @clerk/nextjs (npm): upgrade to 6.23.3 or later; @clerk/nuxt (npm): upgrade to 1.7.5 or later; @clerk/react-router (npm): upgrade to 1.6.4 or later; @clerk/remix (npm): upgrade to 4.8.5 or later; @clerk/tanstack-react-start (npm): upgrade to 0.18.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2025-53548 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2025-53548?** Check whether you run @clerk/astro (npm), @clerk/backend (npm), @clerk/express (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - @clerk/astro (npm): upgrade to 2.10.2 or later ```sh npm install @clerk/astro@2.10.2 ``` - @clerk/backend (npm): upgrade to 2.4.0 or later ```sh npm install @clerk/backend@2.4.0 ``` - @clerk/express (npm): upgrade to 1.7.4 or later ```sh npm install @clerk/express@1.7.4 ``` - @clerk/fastify (npm): upgrade to 2.4.4 or later ```sh npm install @clerk/fastify@2.4.4 ``` - @clerk/nextjs (npm): upgrade to 6.23.3 or later ```sh npm install @clerk/nextjs@6.23.3 ``` - @clerk/nuxt (npm): upgrade to 1.7.5 or later ```sh npm install @clerk/nuxt@1.7.5 ``` - @clerk/react-router (npm): upgrade to 1.6.4 or later ```sh npm install @clerk/react-router@1.6.4 ``` - @clerk/remix (npm): upgrade to 4.8.5 or later ```sh npm install @clerk/remix@4.8.5 ``` - @clerk/tanstack-react-start (npm): upgrade to 0.18.3 or later ```sh npm install @clerk/tanstack-react-start@0.18.3 ``` ## Technical details The verifyWebhook() helper in multiple Clerk SDKs (backend, nextjs, remix, express, fastify, nuxt, astro, react-router, tanstack-react-start) failed to properly parse and validate webhook request signatures. The vulnerability is rooted in CWE-345 (Insufficient Verification of Data Authenticity): the helper did not correctly compare received signatures against the expected HMAC signature derived from the webhook payload. An unauthenticated, network-accessible attacker can send forged webhook events to applications without providing a valid signature. The fix (implemented in @clerk/backend 2.4.0 and corresponding versions in dependent packages) corrects signature parsing and comparison logic. No user interaction is required; exploitation occurs during normal webhook processing. ## Affected products - Clerk @clerk/backend 2.0.0 to 2.3.x - Clerk @clerk/nextjs 6.2.10 to 6.23.2 - Clerk @clerk/remix 4.8.0 to 4.8.4 - Clerk @clerk/express 1.6.0 to 1.7.3 - Clerk @clerk/fastify 2.3.0 to 2.4.3 - Clerk @clerk/nuxt 1.7.0 to 1.7.4 - Clerk @clerk/astro 2.9.0 to 2.10.1 - Clerk @clerk/react-router 1.5.0 to 1.6.3 - Clerk @clerk/tanstack-react-start 0.16.0 to 0.18.2 ## Identifiers - CVE-2025-53548 - GHSA-9mp4-77wg-rwx9 ## Timeline - 2025-07-09: disclosed: Vulnerability published in GHSA and CVE databases - 2025-07-09: patched: Patches released across all affected Clerk packages ## References - [https://github.com/clerk/javascript/security/advisories/GHSA-9mp4-77wg-rwx9](https://github.com/clerk/javascript/security/advisories/GHSA-9mp4-77wg-rwx9) ## Related threats - [Clerk JavaScript SDKs authorization bypass in combined predicates](https://junglewise.ai/threats/cve-2026-42349-clerk-javascript-sdks-authorization-bypass-in-combined-predicates) - [Official Clerk JavaScript SDKs: Middleware-based route protection bypass](https://junglewise.ai/threats/cve-2026-41248-official-clerk-javascript-sdks-middleware-based-route-protection) - [Clerk backend SSRF in clerkFrontendApiProxy feature](https://junglewise.ai/threats/cve-2026-34076-clerk-backend-ssrf-in-clerkfrontendapiproxy-feature) - [Clerk nextjs auth() and getAuth() IDOR vulnerability](https://junglewise.ai/threats/cve-2024-22206-clerk-nextjs-auth-and-getauth-idor-vulnerability)