https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T07:51:47.674401+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-247129 EUVD-2026-247129 2026-10-06T07:51:47.721413+00:00 EUVD-2026-247129 https://cve.radiocsirt.org/vuln/fkie_cve-2025-53548 fkie_cve-2025-53548 2026-10-06T07:51:47.721448+00:00

Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.

 https://cve.radiocsirt.org/vuln/ghsa-9mp4-77wg-rwx9 GHSA-9mp4-77wg-rwx9 — @clerk/backend Performs Insufficient Verification of Data Authenticity 2026-10-06T07:51:47.721480+00:00

Affected: npm: @clerk/backend, npm: @clerk/astro, npm: @clerk/express, npm: @clerk/fastify, npm: @clerk/nextjs, npm: @clerk/nuxt, npm: @clerk/react-router, npm: @clerk/remix, npm: @clerk/tanstack-react-start

### Impact

Applications that use the `verifyWebhook()` helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.

### Patches

* `@clerk/backend`: the helper has been patched as of `2.4.0` * `@clerk/astro`: the helper has been patched as of `2.10.2` * `@clerk/express`: the helper has been patched as of `1.7.4` * `@clerk/fastify`: the helper has been patched as of `2.4.4` * `@clerk/nextjs`: the helper has been patched as of `6.23.3` * `@clerk/nuxt`: the helper has been patched as of `1.7.5` * `@clerk/react-router`: the helper has been patched as of `1.6.4` * `@clerk/remix`: the helper has been patched as of `4.8.5` * `@clerk/tanstack-react-start`: the helper has been patched as of `0.18.3`

### Resolution

The issue was resolved in **`@clerk/backend` `2.4.0`** by:

* Properly parsing the webhook request's signatures and comparing them against the signature generated from the received event

### Workarounds

If unable to upgrade, developers can workaround this issue by verifying webhooks manually, per [this documentation](https://clerk.com/docs/webhooks/overview#protect-your-webhooks-from-abuse).