CVE-2026-34076: SSRF Vulnerability in @clerk/backend and Related Packages Exposes Secret Keys
Summary
CVE-2026-34076: Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host. Affects @clerk/backend versions >= 3.0.0, < 3.2.3. Fixed in 3.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @clerk/backend package is a part of the Clerk authentication system, which provides user management and authentication services for web applications. It allows developers to easily integrate user sign-up, sign-in, and profile management features into their applications. However, a specific feature, clerkFrontendApiProxy, is vulnerable to Server-Side Request Forgery (SSRF), which could lead to the exposure of sensitive information, such as secret keys, to unauthorized parties.
Vulnerability Detail
The vulnerability arises from the clerkFrontendApiProxy function in the @clerk/backend package, which is susceptible to SSRF attacks. An unauthenticated attacker can manipulate the request path to redirect the proxy to an attacker-controlled server, potentially leaking the application's Clerk-Secret-Key. This could allow attackers to gain unauthorized access to user data and perform malicious actions on behalf of the application.
How To Fix
Minimum fixed version
3.2.3
This is the first release that contains the fix.
npm install @clerk/backend@3.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are using the frontendApiProxy feature, you can disable it to mitigate the risk until you can upgrade. Check your code for instances of the following patterns and remove or comment them out:
app.use(clerkMiddleware({ frontendApiProxy: { enabled: true } }));
fastify.register(clerkPlugin, { frontendApiProxy: { enabled: true } });
Additionally, audit your access logs for any suspicious activity related to the proxy endpoint.
Conclusion
The CVE-2026-34076 vulnerability in the @clerk/backend package poses a significant risk due to its potential to expose sensitive secret keys through SSRF attacks. It is crucial for developers using the affected packages to upgrade to the patched versions and take necessary precautions to secure their applications.
See every vulnerability recorded for @clerk/backend →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially exposing sensitive data.
Search your codebase for the 'frontendApiProxy' option. If you find any instances of it being enabled, your application may be affected.
Immediately rotate your Clerk Secret Key in the Clerk Dashboard under API Keys and upgrade to the patched versions of the affected packages.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for @clerk/backend.
