GHSA-9mp4-77wg-rwx9

Source

https://github.com/advisories/GHSA-9mp4-77wg-rwx9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-9mp4-77wg-rwx9/GHSA-9mp4-77wg-rwx9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9mp4-77wg-rwx9

Aliases

CVE-2025-53548

Published

2025-07-09T18:07:40Z

Modified

2025-07-09T20:15:13Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

@clerk/backend Performs Insufficient Verification of Data Authenticity

Details

Impact

Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.

Patches

@clerk/backend: the helper has been patched as of 2.4.0
@clerk/astro: the helper has been patched as of 2.10.2
@clerk/express: the helper has been patched as of 1.7.4
@clerk/fastify: the helper has been patched as of 2.4.4
@clerk/nextjs: the helper has been patched as of 6.23.3
@clerk/nuxt: the helper has been patched as of 1.7.5
@clerk/react-router: the helper has been patched as of 1.6.4
@clerk/remix: the helper has been patched as of 4.8.5
@clerk/tanstack-react-start: the helper has been patched as of 0.18.3

Resolution

The issue was resolved in @clerk/backend 2.4.0 by:

Properly parsing the webhook request's signatures and comparing them against the signature generated from the received event

Workarounds

If unable to upgrade, developers can workaround this issue by verifying webhooks manually, per this documentation.

Database specific

{
    "cwe_ids":  [
        "CWE-345"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-07-09T18:07:40Z",
    "nvd_published_at":  "2025-07-09T18:15:24Z",
    "severity":  "HIGH"
}

References

Affected packages

npm

@clerk/backend

Package

Name: @clerk/backend; View open source insights on deps.dev
Purl: pkg:npm/%40clerk/backend

Affected ranges

Type: SEMVER
Events: Introduced

2.0.0

Fixed

2.4.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-9mp4-77wg-rwx9/GHSA-9mp4-77wg-rwx9.json"

@clerk/astro

Package

Name: @clerk/astro; View open source insights on deps.dev
Purl: pkg:npm/%40clerk/astro

Affected ranges

Type: SEMVER
Events: Introduced

2.9.0

Fixed

2.10.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-9mp4-77wg-rwx9/GHSA-9mp4-77wg-rwx9.json"

@clerk/express

Package

Name: @clerk/express; View open source insights on deps.dev
Purl: pkg:npm/%40clerk/express

Affected ranges

Type: SEMVER
Events: Introduced

1.6.0

Fixed

1.7.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-9mp4-77wg-rwx9/GHSA-9mp4-77wg-rwx9.json"

@clerk/fastify

Package

Name: @clerk/fastify; View open source insights on deps.dev
Purl: pkg:npm/%40clerk/fastify

Affected ranges

Type: SEMVER
Events: Introduced

2.3.0

Fixed

2.4.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-9mp4-77wg-rwx9/GHSA-9mp4-77wg-rwx9.json"

@clerk/nextjs

Package

Name: @clerk/nextjs; View open source insights on deps.dev
Purl: pkg:npm/%40clerk/nextjs

Affected ranges

Type: SEMVER
Events: Introduced

6.2.10

Fixed

6.23.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-9mp4-77wg-rwx9/GHSA-9mp4-77wg-rwx9.json"

@clerk/nuxt

Package

Name: @clerk/nuxt; View open source insights on deps.dev
Purl: pkg:npm/%40clerk/nuxt

Affected ranges

Type: SEMVER
Events: Introduced

1.7.0

Fixed

1.7.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-9mp4-77wg-rwx9/GHSA-9mp4-77wg-rwx9.json"

@clerk/react-router

Package

Name: @clerk/react-router; View open source insights on deps.dev
Purl: pkg:npm/%40clerk/react-router

Affected ranges

Type: SEMVER
Events: Introduced

1.5.0

Fixed

1.6.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-9mp4-77wg-rwx9/GHSA-9mp4-77wg-rwx9.json"

@clerk/remix

Package

Name: @clerk/remix; View open source insights on deps.dev
Purl: pkg:npm/%40clerk/remix

Affected ranges

Type: SEMVER
Events: Introduced

4.8.0

Fixed

4.8.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-9mp4-77wg-rwx9/GHSA-9mp4-77wg-rwx9.json"

@clerk/tanstack-react-start

Package

Name: @clerk/tanstack-react-start; View open source insights on deps.dev
Purl: pkg:npm/%40clerk/tanstack-react-start

Affected ranges

Type: SEMVER
Events: Introduced

0.16.0

Fixed

0.18.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-9mp4-77wg-rwx9/GHSA-9mp4-77wg-rwx9.json"