Nixpkgs security tracker
7.4 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse dismissed (not in Nixpkgs)
Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and @clerk/fastify from versions 3.1.0 to before 3.1.5, the clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's Clerk-Secret-Key to an attacker-controlled server. This issue has been patched in @clerk/hono version 0.1.5, @clerk/express version 2.0.7, @clerk/backend version 3.2.3, and @clerk/fastify version 3.1.5.
References
-
https://github.com/clerk/javascript/security/advisories/GHSA-gjxx-92w9-8v8f x_refsource_CONFIRM
Affected products
- ==@clerk/fastify >= 3.1.0, < 3.1.5
- ==@clerk/backend >= 3.0.0, < 3.2.3
- ==@clerk/express >= 2.0.0, < 2.0.7
- ==@clerk/hono >= 0.1.0, < 0.1.5
Matching in nixpkgs
pkgs.javascript-typescript-langserver
JavaScript and TypeScript code intelligence through the Language Server Protocol
pkgs.haskellPackages.gi-javascriptcore
JavaScriptCore 6.x bindings (compatibility layer)
pkgs.perlPackages.JavaScriptMinifierXS
XS based JavaScript minifier
pkgs.haskellPackages.gi-javascriptcore4
JavaScriptCore 4.x bindings
pkgs.haskellPackages.gi-javascriptcore6
JavaScriptCore 6.x bindings
-
nixos-unstable javascriptcore6-6.0.5
- nixpkgs-unstable javascriptcore6-6.0.5
- nixos-unstable-small javascriptcore6-6.0.5
-
nixos-25.11 javascriptcore6-6.0.5
- nixos-25.11-small javascriptcore6-6.0.5
- nixpkgs-25.11-darwin javascriptcore6-6.0.5
pkgs.haskellPackages.yi-mode-javascript
Yi editor javascript mode
pkgs.perl5Packages.JavaScriptMinifierXS
XS based JavaScript minifier
pkgs.perlPackages.JavaScriptValueEscape
Avoid XSS with JavaScript value interpolation
pkgs.haskellPackages.language-javascript
Parser for JavaScript
pkgs.perl5Packages.JavaScriptValueEscape
Avoid XSS with JavaScript value interpolation
pkgs.perl538Packages.JavaScriptMinifierXS
XS based JavaScript minifier
pkgs.perl540Packages.JavaScriptMinifierXS
XS based JavaScript minifier
pkgs.perl538Packages.JavaScriptValueEscape
Avoid XSS with JavaScript value interpolation
pkgs.perl540Packages.JavaScriptValueEscape
Avoid XSS with JavaScript value interpolation
pkgs.perlPackages.TemplatePluginJavaScript
Encodes text to be safe in JavaScript
pkgs.perl5Packages.TemplatePluginJavaScript
Encodes text to be safe in JavaScript
pkgs.perl538Packages.TemplatePluginJavaScript
Encodes text to be safe in JavaScript
pkgs.perl540Packages.TemplatePluginJavaScript
Encodes text to be safe in JavaScript
pkgs.python312Packages.tree-sitter-javascript
JavaScript and JSX grammar for tree-sitter
pkgs.python313Packages.tree-sitter-javascript
JavaScript and JSX grammar for tree-sitter
pkgs.python314Packages.tree-sitter-javascript
JavaScript and JSX grammar for tree-sitter
pkgs.haskellPackages.webkit2gtk3-javascriptcore
JavaScriptCore FFI from webkitgtk
-
nixos-unstable 2.21.08.31
- nixpkgs-unstable 2.21.08.31
- nixos-unstable-small 2.21.08.31
-
nixos-25.11 2.21.08.31
- nixos-25.11-small 2.21.08.31
- nixpkgs-25.11-darwin 2.21.08.31
-
nixos-unstable 0.0.0+rev=58404d8
- nixpkgs-unstable 0.0.0+rev=58404d8
- nixos-unstable-small 0.0.0+rev=58404d8
-
nixos-unstable 0.0.0+rev=5cc865a
- nixpkgs-unstable 0.0.0+rev=5cc865a
- nixos-unstable-small 0.0.0+rev=5cc865a
pkgs.python312Packages.tree-sitter-grammars.tree-sitter-javascript
Python bindings for tree-sitter-javascript
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-javascript
Python bindings for tree-sitter-javascript
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-javascript
Python bindings for tree-sitter-javascript
Package maintainers
-
@dywedir Vladyslav M. <dywedir@gra.red>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
-
@adfaure Adrien Faure <adfaure@pm.me>
-
@A-jay98 Ali Jamadi <ali@jamadi.me>
-
@doronbehar Doron Behar <me@doronbehar.com>