HighGHSA-9mp4-77wg-rwx9CVE-2025-53548

@clerk/backend Performs Insufficient Verification of Data Authenticity

Published 9 Jul 2025 · Updated 9 Jul 2025

Affected packages

@clerk/backendnpm

Affected: >=2.0.0 <2.4.0
Fixed in: 2.4.0

Update to the fixed version for your release line, for example:npm install @clerk/backend@2.4.0

@clerk/astronpm

Affected: >=2.9.0 <2.10.2
Fixed in: 2.10.2

Update to the fixed version for your release line, for example:npm install @clerk/astro@2.10.2

@clerk/expressnpm

Affected: >=1.6.0 <1.7.4
Fixed in: 1.7.4

Update to the fixed version for your release line, for example:npm install @clerk/express@1.7.4

@clerk/fastifynpm

Affected: >=2.3.0 <2.4.4
Fixed in: 2.4.4

Update to the fixed version for your release line, for example:npm install @clerk/fastify@2.4.4

@clerk/nextjsnpm

Affected: >=6.2.10 <6.23.3
Fixed in: 6.23.3

Update to the fixed version for your release line, for example:npm install @clerk/nextjs@6.23.3

@clerk/nuxtnpm

Affected: >=1.7.0 <1.7.5
Fixed in: 1.7.5

Update to the fixed version for your release line, for example:npm install @clerk/nuxt@1.7.5

@clerk/react-routernpm

Affected: >=1.5.0 <1.6.4
Fixed in: 1.6.4

Update to the fixed version for your release line, for example:npm install @clerk/react-router@1.6.4

@clerk/remixnpm

Affected: >=4.8.0 <4.8.5
Fixed in: 4.8.5

Update to the fixed version for your release line, for example:npm install @clerk/remix@4.8.5

@clerk/tanstack-react-startnpm

Affected: >=0.16.0 <0.18.3
Fixed in: 0.18.3

Update to the fixed version for your release line, for example:npm install @clerk/tanstack-react-start@0.18.3

Details

Impact

Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.

Patches

@clerk/backend: the helper has been patched as of 2.4.0
@clerk/astro: the helper has been patched as of 2.10.2
@clerk/express: the helper has been patched as of 1.7.4
@clerk/fastify: the helper has been patched as of 2.4.4
@clerk/nextjs: the helper has been patched as of 6.23.3
@clerk/nuxt: the helper has been patched as of 1.7.5
@clerk/react-router: the helper has been patched as of 1.6.4
@clerk/remix: the helper has been patched as of 4.8.5
@clerk/tanstack-react-start: the helper has been patched as of 0.18.3

Resolution

The issue was resolved in @clerk/backend 2.4.0 by:

Properly parsing the webhook request's signatures and comparing them against the signature generated from the received event

Workarounds

If unable to upgrade, developers can workaround this issue by verifying webhooks manually, per this documentation.

Is GHSA-9mp4-77wg-rwx9 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected @clerk/backend, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.