package

npm/@clerk/nextjs

pkg:npm/%40clerk/nextjs

HIGH7.5npm

@clerk/backend Performs Insufficient Verification of Data Authenticity

Modified: 7/9/2025

CRITICAL9.0npm

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

Modified: 9/10/2026

CRITICAL9.1npm

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Modified: 5/5/2026

HIGH8.1npm

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Modified: 9/10/2026