`@clerk/nextjs`

Ecosystem:
npm

Package URL:
pkg:npm/@clerk/nextjs

Total PRs:
2,664 Dependabot PRs

Latest PR:
about 19 hours ago

Unique Repositories:
793 repositories

Unique Repos (30 days):
31 repositories

Security Advisories

Clerk has an authorization bypass when combining organization, billing, or reverification checks

GHSA-w24r-5266-9c3c CVE-2026-42349 HIGH published about 2 months ago • updated about 1 hour ago

### Summary `has()`, `auth.protect()`, and related authorization predicates in `@clerk/shared`, `@clerk/nextjs`, `@clerk/backend`, and other frame...

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

GHSA-vqx2-fgx2-5wq9 CVE-2026-41248 CRITICAL published about 2 months ago • updated about 1 hour ago

## Summary `createRouteMatcher` in `@clerk/nextjs`, `@clerk/nuxt`, and `@clerk/astro` can be bypassed by certain crafted requests, allowing them t...

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

GHSA-q6w5-jg5q-47vg CVE-2024-22206 CRITICAL published over 2 years ago • updated about 1 month ago

### Impact Unauthorized access or privilege escalation due to a logic flaw in `auth()` in the App Router or `getAuth()` in the Pages Router. ### A...

6.36.3 → 6.36.5 Patch PR

Open 6 months ago 3 comments

chore(deps): bump the dependencies group with 22 updates

Ashwin-Pulipati/lovibe #40

6.36.2 → 6.36.5 Patch PR

Closed 6 months ago 2 comments

chore(deps): bump @clerk/nextjs from 6.36.2 to 6.36.5

ahmadk953/tasko #1602

6.36.2 → 6.36.5 Patch PR

Open 6 months ago 3 comments

build(deps): bump the patch-update group across 1 directory with 7 updates

Benzou65/chat #360

6.36.2 → 6.36.5 Patch PR

Closed 6 months ago 1 comment

chore(deps): bump the production-dependencies group across 1 directory with 15 updates

TGDev2/Ascendos #9

6.36.3 → 6.36.5 Patch PR

Open 6 months ago 2 comments

Bump @clerk/nextjs from 6.36.4 to 6.36.5

danihengeveld/shurtle-ts #380

6.36.4 → 6.36.5 Patch PR

Open 6 months ago 1 comment

build(deps): bump the patch-update group across 1 directory with 2 updates

Benzou65/chat #359

6.36.2 → 6.36.5 Patch PR

Closed 6 months ago 1 comment

chore(deps): bump the version group across 1 directory with 19 updates

STEAMer-Academy/steamer-academy.me #272

6.36.0 → 6.36.5 Patch PR

Open 6 months ago 4 comments

Bump the dependencies group across 1 directory with 51 updates

Aftab48/Haemologix #12

6.36.2 → 6.36.5 Patch PR

Open 6 months ago 1 comment

chore(deps): bump the production-dependencies group with 8 updates

emilwalter/f1-picks #8

6.36.2 → 6.36.5 Patch PR

Open 6 months ago 2 comments

deps(deps): bump @clerk/nextjs from 6.36.0 to 6.36.5

JovieInc/Jovie #1371

6.36.0 → 6.36.5 Patch PR

Open 6 months ago 4 comments

chore(deps): bump @clerk/nextjs from 6.36.3 to 6.36.5

Ivhene/overwatch-statistics #609

6.36.3 → 6.36.5 Patch PR

Closed 6 months ago 2 comments

chore(deps)(deps): bump @clerk/nextjs from 6.36.4 to 6.36.5

arolariu/arolariu.ro #276

6.36.4 → 6.36.5 Patch PR

Open 6 months ago 2 comments

build(deps): bump the patch-update group with 5 updates

Benzou65/chat #356

6.36.2 → 6.36.5 Patch PR

Closed 6 months ago 1 comment

chore(deps): bump the version group across 1 directory with 18 updates

STEAMer-Academy/steamer-academy.me #271

6.36.0 → 6.36.5 Patch PR

Open 6 months ago 4 comments

chore(deps): bump the minor-and-patch group across 1 directory with 12 updates

bldragon101/worklog #126

6.36.2 → 6.36.5 Patch PR

Open 6 months ago 4 comments

chore(deps): bump the project-dependencies group across 1 directory with 20 updates

JanSzewczyk/greedy-szumrak #34

6.36.2 → 6.36.5 Patch PR

Open 6 months ago 2 comments

chore(deps): bump the npm-dependencies group with 12 updates

michellepace/devflow #16

6.36.2 → 6.36.5 Patch PR

Open 6 months ago 4 comments

chore(deps): bump the minor-and-patch group with 10 updates

bldragon101/worklog #118

6.36.0 → 6.36.2 Patch PR

Open 6 months ago 3 comments

chore(deps): bump the npm-dependencies group with 10 updates

michellepace/devflow #11

6.36.1 → 6.36.2 Patch PR

Open 6 months ago 4 comments

chore(deps): bump the version group across 1 directory with 15 updates

STEAMer-Academy/steamer-academy.me #269

6.36.0 → 6.36.2 Patch PR

Open 6 months ago 4 comments

chore(deps): bump the production-dependencies group across 1 directory with 27 updates

CleanExpo/Unite-Hub #28

6.36.0 → 6.36.2 Patch PR

Closed 6 months ago 5 comments

Bump @clerk/nextjs from 6.36.1 to 6.36.2

timmo001/scratchpad.timmo.dev #1083

6.36.1 → 6.36.2 Patch PR

Closed 6 months ago 1 comment

build(deps): bump the patch-update group across 1 directory with 8 updates

Benzou65/chat #352

6.36.0 → 6.36.2 Patch PR

Closed 6 months ago 1 comment

chore(deps): bump the production-dependencies group across 1 directory with 18 updates

CleanExpo/Unite-Hub #27

6.36.0 → 6.36.1 Patch PR

Open 6 months ago 5 comments

chore(deps): bump @clerk/nextjs from 6.36.0 to 6.36.1

klrab3490/nebula-ecommerce-stack #24

6.36.0 → 6.36.1 Patch PR

Open 6 months ago 1 comment

Bump @clerk/nextjs from 6.36.0 to 6.36.1

timmo001/scratchpad.timmo.dev #1078

6.36.0 → 6.36.1 Patch PR

Closed 6 months ago 1 comment

chore(deps): bump the production-dependencies group across 1 directory with 30 updates

CleanExpo/Unite-Hub #20

6.35.5 → 6.35.6 Patch PR

Open 6 months ago 4 comments

chore(deps): bump the version group across 1 directory with 13 updates

STEAMer-Academy/steamer-academy.me #264

6.35.5 → 6.35.6 Patch PR

Open 6 months ago 3 comments

deps(deps): bump @clerk/nextjs from 6.35.5 to 6.35.6 in the patch-updates group

aamirmursleen/calendarjet-self #5

6.35.5 → 6.35.6 Patch PR

Open 6 months ago 1 comment

chore: bump the npm-deps group across 1 directory with 29 updates

devhaemin/nextjs-boilerplate #3

6.35.1 → 6.35.5 Patch PR

Closed 7 months ago 1 comment

chore: bump the npm-deps group across 1 directory with 27 updates

chean79819-sketch/adadsada #3

6.35.4 → 6.35.5 Patch PR

Closed 7 months ago 1 comment

chore: bump the npm-deps group across 1 directory with 29 updates

EickeOe/nextjs-test #2

6.35.1 → 6.35.5 Patch PR

Closed 7 months ago 1 comment

build(deps): bump the patch-update group across 1 directory with 10 updates

Benzou65/chat #346

6.35.2 → 6.35.5 Patch PR

Closed 7 months ago 1 comment

Bump the dependencies group across 1 directory with 19 updates

amaioru77/starlidigital #9

6.35.0 → 6.35.5 Patch PR

Closed 7 months ago 2 comments

Bump @clerk/nextjs from 6.35.3 to 6.35.4

timmo001/notes.timmo.dev #1272

6.35.3 → 6.35.4 Patch PR

Open 7 months ago 1 comment

Bump the minor-and-patch group across 1 directory with 40 updates

Phazzie/WhispersAndFlames #39

6.35.1 → 6.35.4 Patch PR

Open 7 months ago 2 comments

build(deps): bump the patch-update group with 6 updates

Benzou65/chat #345

6.35.2 → 6.35.4 Patch PR

Closed 7 months ago 1 comment

chore(deps): bump the version group with 2 updates

STEAMer-Academy/steamer-academy.me #256

6.35.3 → 6.35.4 Patch PR

Open 7 months ago 3 comments

Bump @clerk/nextjs from 6.35.2 to 6.35.3

timmo001/notes.timmo.dev #1269

6.35.2 → 6.35.3 Patch PR

Closed 7 months ago 1 comment

chore: bump the npm-deps group with 24 updates

jfeliweb/jfeliweb #2

6.35.1 → 6.35.3 Patch PR

Closed 7 months ago 2 comments

Bump the dependencies group with 11 updates

amaioru77/starlidigital #2

6.35.0 → 6.35.1 Patch PR

Closed 7 months ago 2 comments

chore(deps): bump the version group across 1 directory with 4 updates

STEAMer-Academy/steamer-academy.me #252

6.35.1 → 6.35.2 Patch PR

Open 7 months ago 4 comments

Bump the dependencies group with 14 updates

lucascanna/kosuke-test-prod #4

6.34.1 → 6.34.5 Patch PR

Open 7 months ago 1 comment

chore(fe)(deps): bump the all-dependencies group across 1 directory with 6 updates

HACKMANV8/Hackathon-Comeback #3

6.34.1 → 6.34.5 Patch PR

Open 7 months ago 2 comments

Bump the dependencies group with 12 updates

lucascanna/test-kosuke-22 #2

6.34.1 → 6.34.4 Patch PR

Open 7 months ago 2 comments

Bump the dependencies group with 12 updates

lucascanna/test-kosuke-21 #2

6.34.1 → 6.34.4 Patch PR

Open 7 months ago 2 comments

chore: bump the npm-deps group with 32 updates

octaworksofficial/teymur-mailing-2 #2

6.34.0 → 6.34.4 Patch PR

Closed 7 months ago 1 comment

fix(deps): bump @clerk/nextjs from 6.34.3 to 6.34.4

STEAMer-Academy/steamer-academy.me #223

6.34.3 → 6.34.4 Patch PR

Open 7 months ago 2 comments

fix(deps): bump @clerk/nextjs from 6.34.1 to 6.34.3

STEAMer-Academy/steamer-academy.me #218

6.34.1 → 6.34.3 Patch PR

Open 7 months ago 2 comments

Package Details

Name:	`@clerk/nextjs`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/@clerk/nextjs`
JSON API:	View JSON

Security Advisories

4

Active advisories

CRITICAL 2

HIGH 2

View All npm Advisories

Package Information

Description:

Clerk SDK for NextJS

Repository:	https://github.com/clerk/javascript
Homepage:	https://clerk.com/
Latest Release:	`6.5.1` over 1 year ago
Dependent Repos:	4,066
Dependent Packages:	10
Downloads:	743,795
Ranking:	Top 0.3739% by dependent repos Top 0.5141% by downloads Top 5.8022% by dependent pkgs

PR Status

Open 1,483 (55.7%)

Merged 171 (6.4%)

Closed 829 (31.1%)

PR Types

Major 354 (13.3%)

Minor 1,633 (61.3%)

Patch 496 (18.6%)

@clerk/nextjs

Security Advisories

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

@clerk/backend Performs Insufficient Verification of Data Authenticity

Recent PRs (filtered by: Patch PRs )

Package Details

Security Advisories

4

Package Information

PR Status

PR Types

`@clerk/nextjs`