npm package report

Is @clerk/shared safe?

1 known vulnerability, worst severity HIGH.

cvss

7.6

how bad it is if exploited, out of 10

epss

0.20%

chance of exploitation in the next 30 days

xyz score

3.3

CyberXYZ composite, out of 10

fig. 01 — GHSA-w24r-5266-9c3c, the advisory selected below

// advisories

GHSA-w24r-5266-9c3c

HIGHCVE-2026-42349

has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result should be false, allowing a gated action to proceed for a user who does not satisfy the full set of requested conditions.

Affected: >=0.0.2, <0.1.16, >= 3.0.0, <= 3.47.4
Fixed in: 3.47.5
Weakness: CWE-754
Published: 2026-04-30
Source: osv

NVD MITRE OSV

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 03:27 UTC. The most recent advisory here was published 2026-04-30. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is @clerk/shared safe? npm package security report | CyberXYZ