Description
The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application’s Clerk-Secret-Key to an attacker-controlled server.
Recommendation
Update the @clerk/backend package to the latest compatible version. Followings are version details:
- Affected version(s): >= 3.0.0, <= 3.2.2
- Patched version(s): 3.2.3
References
Could your website be exposed too?
SmartScanner can check your website for Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host - @clerk/hono - CVE-2026-34076
- Strapi may leak sensitive data via relational filtering due to lack of query sanitization - CVE-2026-27886
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/backend - CVE-2026-42349
- Strapi may leak sensitive user information, user reset password, tokens via content-manager views - CVE-2023-36472
You might also like:
See something that needs correcting? Let us knowUpdated April 06, 2026