@clerk/backend Performs Insufficient Verification of Data Authenticity

CAO 7.5CVE-2025-53548 · GHSA-9mp4-77wg-rwx9 · Công bố 09/07/2025 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-53548 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng @clerk/astro, @clerk/backend, @clerk/express.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.17%, cao hơn 6.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.10.2, 2.4.0, 1.7.4, 2.4.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
@clerk/astro npm	`≥ 2.9.0, < 2.10.2`	`2.10.2`
@clerk/backend npm	`≥ 2.0.0, < 2.4.0`	`2.4.0`
@clerk/express npm	`≥ 1.6.0, < 1.7.4`	`1.7.4`
@clerk/fastify npm	`≥ 2.3.0, < 2.4.4`	`2.4.4`
@clerk/nextjs npm	`≥ 6.2.10, < 6.23.3`	`6.23.3`
@clerk/nuxt npm	`≥ 1.7.0, < 1.7.5`	`1.7.5`
@clerk/react-router npm	`≥ 1.5.0, < 1.6.4`	`1.6.4`
@clerk/remix npm	`≥ 4.8.0, < 4.8.5`	`4.8.5`
@clerk/tanstack-react-start npm	`≥ 0.16.0, < 0.18.3`	`0.18.3`

Mô tả

Impact

Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.

Patches

@clerk/backend: the helper has been patched as of 2.4.0
@clerk/astro: the helper has been patched as of 2.10.2
@clerk/express: the helper has been patched as of 1.7.4
@clerk/fastify: the helper has been patched as of 2.4.4
@clerk/nextjs: the helper has been patched as of 6.23.3
@clerk/nuxt: the helper has been patched as of 1.7.5
@clerk/react-router: the helper has been patched as of 1.6.4
@clerk/remix: the helper has been patched as of 4.8.5
@clerk/tanstack-react-start: the helper has been patched as of 0.18.3

Resolution

The issue was resolved in @clerk/backend 2.4.0 by:

Properly parsing the webhook request's signatures and comparing them against the signature generated from the received event

Workarounds

If unable to upgrade, developers can workaround this issue by verifying webhooks manually, per this documentation.

Mô tả của NVD

Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.