Packages / @clerk/nextjs / Security

CriticalVulnerabilityGHSA-q6w5-jg5q-47vgCVE-2024-22206Published 12 Jan 2024

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

Affected releases · @clerk/nextjs

  • 4.x4.7.0 – 4.29.2Fixed in 4.29.3

On 4.x, the newest line:

npm install @clerk/nextjs@4.29.3
7.x

  1. Not affected

    7.0.0 – 7.9.19

    96 releases, latest

4.x

  1. Not affected

    4.0.0 – 4.6.18

    44 releases

  2. Affected

    4.7.0 – 4.29.2

    107 releases

  3. Fixed

    4.29.3 – 4.31.8

    21 releases

597 stable releases of @clerk/nextjs, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @clerk/nextjs. It is read in your browser and sent nowhere.

What happens

Impact

Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router.

Affected Versions

All applications that that use @clerk/nextjs versions in the range of >= 4.7.0,< 4.29.3 in a Next.js backend to authenticate API Routes, App Router, or Route handlers. Specifically, those that call auth() in the App Router or getAuth() in the Pages Router. Only the @clerk/nextjs SDK is impacted. Other SDKs, including other Javascript-based SDKs, are not impacted.

Patches

Fix included in @clerk/nextjs@4.29.3.

References