CVE-2025-53548 — Vulnerability in @clerk/tanstack-react-start —...

HIGH

@clerk/backend Performs Insufficient Verification of Data Authenticity

Published July 9, 2025Updated July 9, 2025Source: osv

Summary

### Impact Applications that use the `verifyWebhook()` helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. ### Patches * `@clerk/backend`: the helper has been patched as of `2.4.0` * `@clerk/astro`: the helper has been patched as of `2.10.2` * `@clerk/express`: the helper has been patched as of `1.7.4` * `@clerk/fastify`: the helper has been patched as of `2.4.4` * `@clerk/nextjs`: the helper has been patched as of `6.23.3` * `@clerk/nuxt`: the helper has been patched as of `1.7.5` * `@clerk/react-router`: the helper has been patched as of `1.6.4` * `@clerk/remix`: the helper has been patched as of `4.8.5` * `@clerk/tanstack-react-start`: the helper has been patched as of `0.18.3` ### Resolution The issue was resolved in **`@clerk/backend` `2.4.0`** by: * Properly parsing the webhook request's signatures and comparing them against the signature generated from the received event ### Workarounds If unable to upgrade, developers can workaround this issue by verifying webhooks manually, per [this documentation](https://clerk.com/docs/webhooks/overview#protect-your-webhooks-from-abuse).

Advisory Timeline

First published July 9, 2025 (460 days ago).
Last revised July 9, 2025 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm

Update @clerk/tanstack-react-start to 0.18.3 or later

npm install @clerk/tanstack-react-start@0.18.3

npm

Update @clerk/astro to 2.10.2 or later

npm install @clerk/astro@2.10.2

npm

Update @clerk/express to 1.7.4 or later

npm install @clerk/express@1.7.4

npm

Update @clerk/nuxt to 1.7.5 or later

npm install @clerk/nuxt@1.7.5

npm

Update @clerk/fastify to 2.4.4 or later

npm install @clerk/fastify@2.4.4

npm

Update @clerk/react-router to 1.6.4 or later

npm install @clerk/react-router@1.6.4

npm

Update @clerk/remix to 4.8.5 or later

npm install @clerk/remix@4.8.5

npm

Update @clerk/nextjs to 6.23.3 or later

npm install @clerk/nextjs@6.23.3

npm

Update @clerk/backend to 2.4.0 or later

npm install @clerk/backend@2.4.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (9)

Affects 1 ecosystem: npm (9).

Package	Ecosystem	Affected	Fixed In
@clerk/tanstack-react-start	npm	All versions	0.18.3
@clerk/astro	npm	All versions	2.10.2
@clerk/express	npm	All versions	1.7.4
@clerk/nuxt	npm	All versions	1.7.5
@clerk/fastify	npm	All versions	2.4.4
@clerk/react-router	npm	All versions	1.6.4
@clerk/remix	npm	All versions	4.8.5
@clerk/nextjs	npm	All versions	6.23.3
@clerk/backend	npm	All versions	2.4.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-345
Insufficient Verification of Data AuthenticityMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Frequently Asked Questions

What is CVE-2025-53548?: @clerk/backend Performs Insufficient Verification of Data Authenticity This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2025-53548?: CVE-2025-53548 affects @clerk/tanstack-react-start, @clerk/astro and @clerk/express (and 6 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-53548 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-9mp4-77wg-rwx9

Related CVEs

CVE-2026-41248
CRITICAL
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
CVE-2026-107375
HIGH
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
CVE-2026-107384
HIGH
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
CVE-2026-42349
HIGH
Clerk has an authorization bypass when combining organization, billing, or reverification checks

More npm advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies