https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:19:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-247129 EUVD-2026-247129 https://cve.radiocsirt.org/vuln/euvd-2026-247129 https://cve.radiocsirt.org/vuln/fkie_cve-2025-53548 <p>Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.</p> <p>Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-53548 https://cve.radiocsirt.org/vuln/ghsa-9mp4-77wg-rwx9 <p><strong>Affected:</strong> npm: @clerk/backend, npm: @clerk/astro, npm: @clerk/express, npm: @clerk/fastify, npm: @clerk/nextjs, npm: @clerk/nuxt, npm: @clerk/react-router, npm: @clerk/remix, npm: @clerk/tanstack-react-start</p> <p>### Impact</p> <p>Applications that use the `verifyWebhook()` helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.</p> <p>### Patches</p> <p>* `@clerk/backend`: the helper has been patched as of `2.4.0` * `@clerk/astro`: the helper has been patched as of `2.10.2` * `@clerk/express`: the helper has been patched as of `1.7.4` * `@clerk/fastify`: the helper has been patched as of `2.4.4` * `@clerk/nextjs`: the helper has been patched as of `6.23.3` * `@clerk/nuxt`: the helper has been patched as of `1.7.5` * `@clerk/react-router`: the helper has been patched as of `1.6.4` * `@clerk/remix`: the helper has been patched as of `4.8.5` * `@clerk/tanstack-react-start`: the helper has been patched as of `0.18.3`</p> <p>### Resolution</p> <p>The issue was resolved in **`@clerk/backend` `2.4.0`** by:</p> <p>* Properly parsing the webhook request&#39;s signatures and comparing them against the signature generated from the received event</p> <p>### Workarounds</p> <p>If unable to upgrade, developers can workaround this issue by verifying webhooks manually, per [this documentation](https://clerk.com/docs/webhooks/overview#protect-your-webhooks-from-abuse).</p> <p><strong>Affected:</strong> npm: @clerk/backend, npm: @clerk/astro, npm: @clerk/express, npm: @clerk/fastify, npm: @clerk/nextjs, npm: @clerk/nuxt, npm: @clerk/react-router, npm: @clerk/remix, npm: @clerk/tanstack-react-start</p> <p>### Impact</p> <p>Applications that use the `verifyWebhook()` helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.</p> <p>### Patches</p> <p>* `@clerk/backend`: the helper has been patched as of `2.4.0` * `@clerk/astro`: the helper has been patched as of `2.10.2` * `@clerk/express`: the helper has been patched as of `1.7.4` * `@clerk/fastify`: the helper has been patched as of `2.4.4` * `@clerk/nextjs`: the helper has been patched as of `6.23.3` * `@clerk/nuxt`: the helper has been patched as of `1.7.5` * `@clerk/react-router`: the helper has been patched as of `1.6.4` * `@clerk/remix`: the helper has been patched as of `4.8.5` * `@clerk/tanstack-react-start`: the helper has been patched as of `0.18.3`</p> <p>### Resolution</p> <p>The issue was resolved in **`@clerk/backend` `2.4.0`** by:</p> <p>* Properly parsing the webhook request&#39;s signatures and comparing them against the signature generated from the received event</p> <p>### Workarounds</p> <p>If unable to upgrade, developers can workaround this issue by verifying webhooks manually, per [this documentation](https://clerk.com/docs/webhooks/overview#protect-your-webhooks-from-abuse).</p> https://cve.radiocsirt.org/vuln/ghsa-9mp4-77wg-rwx9