GHSA-9mp4-77wg-rwx9 | clerk/javascript Security | GitStock

GHSA ID: GHSA-9mp4-77wg-rwx9
CVE ID: CVE-2025-53548
Severity: high
Published: 2025-07-09T18:07:40Z
Updated: 2025-07-09T20:15:14Z
CVSS: 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v3: 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

Impact

Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.

Patches

@clerk/backend: the helper has been patched as of 2.4.0
@clerk/astro: the helper has been patched as of 2.10.2
@clerk/express: the helper has been patched as of 1.7.4
@clerk/fastify: the helper has been patched as of 2.4.4
@clerk/nextjs: the helper has been patched as of 6.23.3
@clerk/nuxt: the helper has been patched as of 1.7.5
@clerk/react-router: the helper has been patched as of 1.6.4
@clerk/remix: the helper has been patched as of 4.8.5
@clerk/tanstack-react-start: the helper has been patched as of 0.18.3

Resolution

The issue was resolved in @clerk/backend 2.4.0 by:

Properly parsing the webhook request's signatures and comparing them against the signature generated from the received event

Workarounds

If unable to upgrade, developers can workaround this issue by verifying webhooks manually, per this documentation.

CWEs

CWE-345 · Insufficient Verification of Data Authenticity

References