@clerk/nextjs

Clerk SDK for NextJS

Latest 7.9.15

88%

Total Score

healthy

Active organization-backed project with strong release, contributor, and build signals; workflow findings are limited to hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Version stability

Version 7.9.15 is a stable major release and is not a prerelease, but 90% of recent versions are prereleases, which adds some release-channel complexity.

Workflow audit

All 16 workflows were analyzed successfully and all 88 action references are pinned, but three high-confidence template-injection findings and four high-confidence ad hoc package-install findings indicate workflow hygiene risks. No untrusted checkout or script-injection sink was found, so these findings do not independently make the release unfit.

Vulnerabilities

Title	Versions	Severity
CVE-2026-41248 @clerk/nextjs is vulnerable to Interpretation Conflict in versions 5.0.0 - 5.7.6, 6.0.0-snapshot.vb87a27f - 6.39.2 and 7.0.0 - 7.2.1.	5.0.0 - 5.7.66.0.0-snapshot.vb87a27f - 6.39.27.0.0 - 7.2.1	Critical
AIKIDO-2024-10213 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @clerk/nextjs is vulnerable to Cross-site Scripting (XSS) in versions 0.0.1 - 5.2.14.	0.0.1 - 5.2.14	Low
CVE-2024-22206 @clerk/nextjs is vulnerable to Improper Access Control in versions 4.7.0 - 4.29.3.	4.7.0 - 4.29.3	Critical

Package versions

Maintainers

Direct Dependencies

Dependency	Last Release	Score
tslib Version 2.8.1	—	—
server-only Version 0.0.1	—	—
@clerk/react Version ^6.17.8	—	—
@clerk/shared Version ^4.40.0	—	—
@clerk/backend Version ^3.23.2	—	—