@clerk/nextjs
Clerk SDK for NextJS
88%
Total Score
healthy
Active maintenance and strong project backing outweigh workflow hygiene concerns, including 89 unpinned actions and high-confidence template-injection findings.
Health Score Breakdown
All 16 workflows were analyzed, with no untrusted checkout or script-injection findings, but 89 of 107 action references are unpinned and three high-confidence template-injection findings were reported in CI; these are meaningful workflow hygiene concerns, though no dangerous trigger-and-sink combination was shown.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-41248 @clerk/nextjs is vulnerable to Interpretation Conflict in versions 5.0.0 - 5.7.6, 6.0.0-snapshot.vb87a27f - 6.39.2 and 7.0.0 - 7.2.1. | 5.0.0 - 5.7.66.0.0-snapshot.vb87a27f - 6.39.27.0.0 - 7.2.1 | Critical |
AIKIDO-2024-10213 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @clerk/nextjs is vulnerable to Cross-site Scripting (XSS) in versions 0.0.1 - 5.2.14. | 0.0.1 - 5.2.14 | Low |
CVE-2024-22206 @clerk/nextjs is vulnerable to Improper Access Control in versions 4.7.0 - 4.29.3. | 4.7.0 - 4.29.3 | Critical |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 tslib Version 2.8.1 | — | — |
server-only Version 0.0.1 | — | — |
@clerk/react Version ^6.17.8 | — | — |
@clerk/shared Version ^4.40.0 | — | — |
@clerk/backend Version ^3.24.0 | — | — |
Weekly Downloads
Info
- Last Published
- 4 hours ago
- Created
- 5 years ago
- Unpacked Size
- 1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.