# CVE-2026-42349: Clerk JavaScript SDKs authorization bypass in combined predicates Source: https://junglewise.ai/threats/cve-2026-42349-clerk-javascript-sdks-authorization-bypass-in-combined-predicates Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-05-11. Updated: 2026-06-09 License: CC BY 4.0 with a link back CVE-2026-42349 · Severity: high · CVSS 8.1 · Published 2026-05-11 Clerk, a popular authentication and user management platform, has a vulnerability in its authorization logic. When developers combine multiple security checks (like checking both a user's role and their billing plan) in a single command, the system may incorrectly grant access even if the user doesn't meet all requirements. This could allow unauthorized users to perform actions or access data they should not be able to see, though it does not allow them to impersonate other users or compromise active sessions. Technologies: [Clerk Backend](https://junglewise.ai/threats/technologies/backend), [Clerk Nextjs](https://junglewise.ai/threats/technologies/nextjs), [@clerk/astro (npm)](https://junglewise.ai/threats/technologies/clerk-astro), [@clerk/backend (npm)](https://junglewise.ai/threats/technologies/clerk-backend), [@clerk/express (npm)](https://junglewise.ai/threats/technologies/clerk-express), [@clerk/fastify (npm)](https://junglewise.ai/threats/technologies/clerk-fastify), [@clerk/nextjs (npm)](https://junglewise.ai/threats/technologies/clerk-nextjs), [@clerk/nuxt (npm)](https://junglewise.ai/threats/technologies/clerk-nuxt). Vendors: [Clerk](https://junglewise.ai/threats/vendors/clerk), [npm](https://junglewise.ai/threats/vendors/npm). ## Quick answers **Is CVE-2026-42349 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42349 being exploited in the wild. **How severe is CVE-2026-42349?** High severity, with a CVSS score of 8.1, published 11 May 2026. **Which products and versions are affected?** Clerk Backend >= 2.0.0, <= 2.33.2; >= 3.0.0, <= 3.2.13; Clerk-Js >= 5.22.0, < 5.125.10; >= 6.0.0, < 6.7.5, >= 5.22.0, <= 5.125.9; >= 6.0.0, <= 6.7.4; Clerk Nextjs >= 6.0.0, <= 6.39.2; >= 7.0.0, <= 7.2.3; Clerk Shared >= 3.0.0, <= 3.47.4; >= 4.0.0, <= 4.8.2; and 17 more. **Is there a fix for CVE-2026-42349?** Yes. @clerk/astro (npm): upgrade to 2.17.11 or later; @clerk/backend (npm): upgrade to 2.33.3 or later; @clerk/chrome-extension (npm): upgrade to 2.9.15 or later; @clerk/clerk-expo (npm): upgrade to 2.19.36 or later; @clerk/clerk-js (npm): upgrade to 5.125.10 or later; @clerk/clerk-react (npm): upgrade to 5.61.6 or later; @clerk/expo (npm): upgrade to 3.2.2 or later; @clerk/express (npm): upgrade to 1.7.79 or later; @clerk/fastify (npm): upgrade to 2.6.31 or later; @clerk/hono (npm): upgrade to 0.1.16 or later; @clerk/nextjs (npm): upgrade to 6.39.3 or later; @clerk/nuxt (npm): upgrade to 1.13.29 or later; @clerk/react (npm): upgrade to 6.4.3 or later; @clerk/react-router (npm): upgrade to 2.4.13 or later; @clerk/shared (npm): upgrade to 3.47.5 or later; @clerk/tanstack-react-start (npm): upgrade to 0.29.11 or later; @clerk/vue (npm): upgrade to 1.17.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-42349 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-42349?** Check whether you run Clerk Backend, Clerk-Js, Clerk Nextjs or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - @clerk/astro (npm): upgrade to 2.17.11 or later ```sh npm install @clerk/astro@2.17.11 ``` - @clerk/backend (npm): upgrade to 2.33.3 or later ```sh npm install @clerk/backend@2.33.3 ``` - @clerk/chrome-extension (npm): upgrade to 2.9.15 or later ```sh npm install @clerk/chrome-extension@2.9.15 ``` - @clerk/clerk-expo (npm): upgrade to 2.19.36 or later ```sh npm install @clerk/clerk-expo@2.19.36 ``` - @clerk/clerk-js (npm): upgrade to 5.125.10 or later ```sh npm install @clerk/clerk-js@5.125.10 ``` - @clerk/clerk-react (npm): upgrade to 5.61.6 or later ```sh npm install @clerk/clerk-react@5.61.6 ``` - @clerk/expo (npm): upgrade to 3.2.2 or later ```sh npm install @clerk/expo@3.2.2 ``` - @clerk/express (npm): upgrade to 1.7.79 or later ```sh npm install @clerk/express@1.7.79 ``` - @clerk/fastify (npm): upgrade to 2.6.31 or later ```sh npm install @clerk/fastify@2.6.31 ``` - @clerk/hono (npm): upgrade to 0.1.16 or later ```sh npm install @clerk/hono@0.1.16 ``` - @clerk/nextjs (npm): upgrade to 6.39.3 or later ```sh npm install @clerk/nextjs@6.39.3 ``` - @clerk/nuxt (npm): upgrade to 1.13.29 or later ```sh npm install @clerk/nuxt@1.13.29 ``` - @clerk/react (npm): upgrade to 6.4.3 or later ```sh npm install @clerk/react@6.4.3 ``` - @clerk/react-router (npm): upgrade to 2.4.13 or later ```sh npm install @clerk/react-router@2.4.13 ``` - @clerk/shared (npm): upgrade to 3.47.5 or later ```sh npm install @clerk/shared@3.47.5 ``` - @clerk/tanstack-react-start (npm): upgrade to 0.29.11 or later ```sh npm install @clerk/tanstack-react-start@0.29.11 ``` - @clerk/vue (npm): upgrade to 1.17.21 or later ```sh npm install @clerk/vue@1.17.21 ``` ## Technical details An authorization bypass exists in several Clerk SDKs, including @clerk/shared, @clerk/nextjs, and @clerk/backend. The vulnerability occurs when authorization predicates (e.g., `has()`, `auth.protect()`) are used with combined checks, such as pairing a 'reverification' check with a 'role' or 'permission', or pairing 'billing' checks with 'role' checks. In these specific configurations, the logic may incorrectly evaluate to true even if one condition is not met. Additionally, a secondary issue in @clerk/nextjs caused `auth.protect()` to ignore authorization parameters entirely if specific URL or token arguments were present in the same object. Attackers with low privileges can exploit this over a network to bypass intended access controls. Patches are available across all affected major version lines. ## Affected products - Clerk @clerk/shared >= 3.0.0, <= 3.47.4; >= 4.0.0, <= 4.8.2 - Clerk @clerk/nextjs >= 6.0.0, <= 6.39.2; >= 7.0.0, <= 7.2.3 - Clerk @clerk/backend >= 2.0.0, <= 2.33.2; >= 3.0.0, <= 3.2.13 - Clerk @clerk/clerk-js >= 5.22.0, <= 5.125.9; >= 6.0.0, <= 6.7.4 ## Identifiers - CVE-2026-42349 - GHSA-w24r-5266-9c3c ## Timeline - 2026-04-18: disclosed: Reported by AISafe - 2026-04-22: patched - 2026-04-22: advisory ## References - [https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c](https://github.com/clerk/javascript/security/advisories/GHSA-w24r-5266-9c3c) - [https://api.github.com/repos/clerk/javascript/security-advisories/GHSA-w24r-5266-9c3c](https://api.github.com/repos/clerk/javascript/security-advisories/GHSA-w24r-5266-9c3c) ## Related threats - [Official Clerk JavaScript SDKs: Middleware-based route protection bypass](https://junglewise.ai/threats/cve-2026-41248-official-clerk-javascript-sdks-middleware-based-route-protection) - [Clerk backend SSRF in clerkFrontendApiProxy feature](https://junglewise.ai/threats/cve-2026-34076-clerk-backend-ssrf-in-clerkfrontendapiproxy-feature) - [Clerk-js authentication bypass at OTP verification](https://junglewise.ai/threats/cve-2025-63700-clerk-clerk-js-oauth-authentication-bypass-in-otp-verification) - [Clerk webhook verifyWebhook insufficient signature verification](https://junglewise.ai/threats/cve-2025-53548-clerk-webhook-verifywebhook-insufficient-signature-verification) - [Clerk nextjs auth() and getAuth() IDOR vulnerability](https://junglewise.ai/threats/cve-2024-22206-clerk-nextjs-auth-and-getauth-idor-vulnerability)