@clerk/clerk-js

6.40.0 · 20 Oct 2026MIT532.6k / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Paste your package.json, or type the range you declare for @clerk/clerk-js. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	6.40.0	Safe from 6.7.5
	5.128.1	Safe from 5.125.10
	4.73.14	5 open advisories, worst moderate · last release Mar 2025, no longer updated

Your version

High
Clerk has an authorization bypass when combining organization, billing, or reverification checksGHSA-w24r-5266-9c3c · 30 Apr 2026
- 6.x6.0.0 – 6.7.4Fixed in 6.7.5
- 5.x5.22.0 – 5.125.9Fixed in 5.125.10
Moderate
Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stageGHSA-3mm3-wfpv-q85g · 20 Nov 2025
- 5.x5.0.0 – 5.88.0Fixed in 5.89.0
- 4.x and older0.0.1 – 4.73.14No fix, no longer updated · move to 5.89.0

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 23 Oct 2026. Releases and advisories last read 23 Oct 2026.