CVE-2026-34076

Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5.

• CWE-918

• https://github.com/clerk/javascript/security/advisories/GHSA-gjxx-92w9-8v8f

Published

Apr 1, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34069nimiq/core-rs-albatross is a Rust implementation of the Nimi…5.3
• CVE-2026-3407A vulnerability was determined in YosysHQ yosys up to 0.62. …3.3
• CVE-2026-34070LangChain is a framework for building agents and LLM-powered…7.5
• CVE-2026-34071Stirling-PDF is a locally hosted web application that allows…6.1
• CVE-2026-34072Cr*nMaster (cronmaster) is a Cronjob management UI with huma…9.8
• CVE-2026-34073cryptography is a package designed to expose cryptographic p…5.3
• CVE-2026-34077React Router is a router for React. In versions 7.7.0 throug…7.5
• CVE-2026-34078Flatpak is a Linux application sandboxing and distribution f…10
• CVE-2026-34079Flatpak is a Linux application sandboxing and distribution f…7.5
• CVE-2026-3408A vulnerability was identified in Open Babel up to 3.1.1. Th…6.5
• CVE-2026-34080xdg-dbus-proxy is a filtering proxy for D-Bus connections. P…5.5
• CVE-2026-34082Dify is an open-source LLM app development platform. Prior t…4.3