CriticalGHSA-q6w5-jg5q-47vgCVE-2024-22206

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

Published 12 Jan 2024 · Updated 10 Sept 2026

Affected package

@clerk/nextjsnpm
Affected
>=4.7.0 <4.29.3
Fixed in
4.29.3
Update to the fixed version for your release line, for example:npm install @clerk/nextjs@4.29.3

Details

Impact

Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router.

Affected Versions

All applications that that use @clerk/nextjs versions in the range of >= 4.7.0,< 4.29.3 in a Next.js backend to authenticate API Routes, App Router, or Route handlers. Specifically, those that call auth() in the App Router or getAuth() in the Pages Router. Only the @clerk/nextjs SDK is impacted. Other SDKs, including other Javascript-based SDKs, are not impacted.

Patches

Fix included in @clerk/nextjs@4.29.3.

References

  • https://clerk.com/changelog/2024-01-12
  • https://github.com/clerk/javascript/releases/tag/%40clerk%2Fnextjs%404.29.3

Is GHSA-q6w5-jg5q-47vg in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected @clerk/nextjs, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.