Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

Description

The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application’s Clerk-Secret-Key to an attacker-controlled server.

Recommendation

Update the @clerk/backend package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, <= 3.2.2
• Patched version(s): 3.2.3

References

• GHSA-gjxx-92w9-8v8f
• CVE-2026-34076
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host - @clerk/hono - CVE-2026-34076
• Strapi may leak sensitive data via relational filtering due to lack of query sanitization - CVE-2026-27886
• Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/backend - CVE-2026-42349
• Strapi may leak sensitive user information, user reset password, tokens via content-manager views - CVE-2023-36472

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@clerk/backend