EUVD-2026-278520

fkie_cve-2026-34076

Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5.

GHSA-gjxx-92w9-8v8f — Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

Affected: npm: @clerk/backend, npm: @clerk/express, npm: @clerk/hono, npm: @clerk/fastify

## Summary

The `clerkFrontendApiProxy` function in `@clerk/backend` is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's `Clerk-Secret-Key` to an attacker-controlled server.

## Affected packages

Only applications that have opted into the `frontendApiProxy` feature are affected. This feature is not enabled by default. **Users of `@clerk/nextjs` are not affected** due to how the framework handles repeated `/` in request paths.

| Package | Affected versions | Fixed version | |---|---|---| | `@clerk/backend` | `>= 3.0.0, <= 3.2.2` | `3.2.3` | | `@clerk/express` | `>= 2.0.0, <= 2.0.6` | `2.0.7` | | `@clerk/hono` | `>= 0.1.0, <= 0.1.4` | `0.1.5` | | `@clerk/fastify` | `>= 3.1.0, <= 3.1.4` | `3.1.5` |

Search your codebase for the `frontendApiProxy` option. If none of the patterns below appear in your code, you are not affected.

**@clerk/express** ```ts app.use(clerkMiddleware({ frontendApiProxy: { enabled: true } })); ```

**@clerk/hono** ```ts app.use('*', clerkMiddleware({ frontendApiProxy: { enabled: true } })); ```

**@clerk/fastify** ```ts fastify.register(clerkPlugin, { frontendApiProxy: { enabled: true } }); ```

**@clerk/backend** ```ts import { clerkFrontendApiProxy } from '@clerk/backend/proxy'; ```

A quick way to check across your entire project:

```sh grep -r "frontendApiProxy\|clerkFrontendApiProxy" . ```

If there are no matches, you are not using this feature.…

Most recent entries from all

EUVD-2026-278520

fkie_cve-2026-34076

GHSA-gjxx-92w9-8v8f — Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host