Server-Side Request Forgery Vulnerability in Clerk Authentication JavaScript Library
CVE-2026-34076

7.4HIGH

Key Information:

Vendor

Clerk

Status
Javascript
Vendor
CVE Published:
1 April 2026

What is CVE-2026-34076?

The Clerk JavaScript library contains a vulnerability that allows for Server-Side Request Forgery (SSRF) in specific versions. An unauthenticated attacker can manipulate the request path, potentially exposing sensitive information such as the Clerk-Secret-Key to an external server. This flaw affects multiple components of Clerk's authentication solutions, including @clerk/hono, @clerk/express, @clerk/backend, and @clerk/fastify. Updates have been released to mitigate this issue, and users are strongly advised to upgrade to the latest versions to ensure the security of their applications.

Affected Version(s)

javascript @clerk/hono >= 0.1.0, < 0.1.5 < @clerk/hono 0.1.0, 0.1.5

javascript @clerk/express >= 2.0.0, < 2.0.7 < @clerk/express 2.0.0, 2.0.7

javascript @clerk/backend >= 3.0.0, < 3.2.3 < @clerk/backend 3.0.0, 3.2.3

References

https://github.com/clerk/javascript/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.