CRITICAL9.1npm
GHSA-vqx2-fgx2-5wq9· CVE-2026-41248Official Clerk JavaScript SDKs: Middleware-based route protection bypass
Modified: 5/5/2026
package
npm/@clerk/shared
pkg:npm/%40clerk/shared
HIGH8.1npm
GHSA-w24r-5266-9c3c· CVE-2026-42349Clerk has an authorization bypass when combining organization, billing, or reverification checks
Modified: 9/10/2026