@clerk/backend Performs Insufficient Verification of Data Authenticity

高 7.5CVE-2025-53548 · GHSA-9mp4-77wg-rwx9 · 09/07/2025 公開 · 17/06/2026 更新

要点

CVE-2025-53548 は @clerk/astro, @clerk/backend, @clerk/express に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.17%（全脆弱性の 6.6% より高い）。
対処：2.10.2, 2.4.0, 1.7.4, 2.4.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
@clerk/astro npm	`≥ 2.9.0, < 2.10.2`	`2.10.2`
@clerk/backend npm	`≥ 2.0.0, < 2.4.0`	`2.4.0`
@clerk/express npm	`≥ 1.6.0, < 1.7.4`	`1.7.4`
@clerk/fastify npm	`≥ 2.3.0, < 2.4.4`	`2.4.4`
@clerk/nextjs npm	`≥ 6.2.10, < 6.23.3`	`6.23.3`
@clerk/nuxt npm	`≥ 1.7.0, < 1.7.5`	`1.7.5`
@clerk/react-router npm	`≥ 1.5.0, < 1.6.4`	`1.6.4`
@clerk/remix npm	`≥ 4.8.0, < 4.8.5`	`4.8.5`
@clerk/tanstack-react-start npm	`≥ 0.16.0, < 0.18.3`	`0.18.3`

概要

Impact

Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.

Patches

@clerk/backend: the helper has been patched as of 2.4.0
@clerk/astro: the helper has been patched as of 2.10.2
@clerk/express: the helper has been patched as of 1.7.4
@clerk/fastify: the helper has been patched as of 2.4.4
@clerk/nextjs: the helper has been patched as of 6.23.3
@clerk/nuxt: the helper has been patched as of 1.7.5
@clerk/react-router: the helper has been patched as of 1.6.4
@clerk/remix: the helper has been patched as of 4.8.5
@clerk/tanstack-react-start: the helper has been patched as of 0.18.3

Resolution

The issue was resolved in @clerk/backend 2.4.0 by:

Properly parsing the webhook request's signatures and comparing them against the signature generated from the received event

Workarounds

If unable to upgrade, developers can workaround this issue by verifying webhooks manually, per this documentation.

NVD の説明

Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.