CVE-2025-53548 @clerk/backend Performs Insufficient Verification of Data Authenticity
Attackers can bypass webhook signature verification in Clerk backend applications, allowing them to inject fake events. Developers using verifyWebhook() must upgrade.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53548?
CVE-2025-53548 is a high-severity vulnerability in clerk javascript, published on 9 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events. The issue was resolved in @clerk/backend 2.4.0.
Weakness: CWE-345
Which versions are affected by CVE-2025-53548?
18 open source packages ship an affected version, including @clerk/astro, @clerk/backend and @clerk/express.
| Package | Affected | Fixed in |
|---|---|---|
@clerk/astro npm | From 2.9.0 | 2.10.2 |
@clerk/astro npm | From 2.9.0 | 2.10.2 |
@clerk/backend npm | From 2.0.0 | 2.4.0 |
@clerk/backend npm | From 2.0.0 | 2.4.0 |
@clerk/express npm | From 1.6.0 | 1.7.4 |
@clerk/express npm | From 1.6.0 | 1.7.4 |
12 more packages
@clerk/fastify npm | From 2.3.0 | 2.4.4 |
@clerk/fastify npm | From 2.3.0 | 2.4.4 |
@clerk/nextjs npm | From 6.2.10 | 6.23.3 |
@clerk/nextjs npm | From 6.2.10 | 6.23.3 |
@clerk/nuxt npm | From 1.7.0 | 1.7.5 |
@clerk/nuxt npm | From 1.7.0 | 1.7.5 |
@clerk/react-router npm | From 1.5.0 | 1.6.4 |
@clerk/react-router npm | From 1.5.0 | 1.6.4 |
@clerk/remix npm | From 4.8.0 | 4.8.5 |
@clerk/remix npm | From 4.8.0 | 4.8.5 |
@clerk/tanstack-react-start npm | From 0.16.0 | 0.18.3 |
@clerk/tanstack-react-start npm | From 0.16.0 | 0.18.3 |
How do I fix CVE-2025-53548?
Upgrade @clerk/astro to 2.10.2 or later.
Is CVE-2025-53548 being exploited?
There is no known exploitation of CVE-2025-53548 in the wild and no public exploit code.
Sources
Also known as GHSA-9mp4-77wg-rwx9.