---
collection: auth-identity
collection_name: Auth & Identity
week_start: 2026-07-13
title: Security hardening at the foundation
release_count: 94
generated: 2026-07-20
canonical: https://releases.sh/collections/auth-identity/digest/2026-07-13
---

# Security hardening at the foundation

Clerk patched a stored XSS vector in SSR script tags, locked down IPC origin validation in Electron, and announced TLS cipher suite deprecation, while the Clerk JS SDK gained timeout-based failure recovery for slow Frontend API endpoints.

### Stored XSS fix across the SDK stack

The most critical work this week spans multiple Clerk packages that share a common SSR pattern. Three releases — [Clerk JavaScript SDK](/release/rel_jhqhjKS9pRx6_L4kda9DL-clerk-javascript-sdk-patch-escapes-ssr-script-tags-to-prevent-stored-xss), [@clerk/tanstack-react-start](/release/rel_1aIV1eYBWbUDmHhdekQnC-clerk-tanstack-react-start-1-4-20-patches-stored-xss-via-session-claim-in-ssr), and [Clerk Astro](/release/rel_RnkuXrEyHdosoCdY7MTNO-clerk-astro-v3-4-19-fixes-stored-xss-via-serialized-session-claims) — all patch the same vulnerability: user-controllable session claims containing `</script>` could break out of the SSR `<script>` tag where Clerk serializes auth state, enabling stored XSS. The fix escapes `<`, `>`, and `/` during serialization while preserving identical JSON values on the client. If you're using any of these SDKs, the patch is a recommended upgrade.

### Hardening IPC, session tokens, and TLS

Clerk's Electron SDK [v0.0.16](/release/rel_WachTvo3yRoOYNfgAQyks-clerk-electron-v0-0-16-validates-ipc-origin-to-prevent-token-theft-from) validates that token-cache and OAuth-transport IPC requests originate from a top-level window's main frame, preventing a subframe or `<webview>` that shares the Clerk preload from reading the persisted client JWT or driving the OAuth flow. Meanwhile, [@clerk/backend v3.11.7](/release/rel_sPLWntZmHusWVnIcxnVFB-clerk-backend-v3-11-7-rejects-machine-tokens-in-session-cookie) rejects machine tokens (M2M and OAuth JWTs) presented in the `__session` cookie — previously such a token could pass session verification and produce a signed-in state with a machine identity as `userId`, defeating `if (userId)` authorization checks. On the infrastructure side, Clerk [announced](/release/rel_srvTGeYmkCHq6i_vnk7yg-clerk-to-phase-out-cbc-cipher-suites-on-subdomains-by-january-2027) that CBC-mode TLS cipher suites will be removed from Clerk-managed subdomains in January 2027; clients that can only negotiate CBC will fail the handshake when certificates rotate.

### Faster failure recovery and platform polish

The [Clerk JS SDK v6.25.3](/release/rel_-9PCDim4uk6M0pMV6izcm-clerk-js-sdk-6-25-3-fails-fast-on-slow-fapi-prevents-load-hang) and [@clerk/shared v4.25.3](/release/rel_q8DmuwFGHBO-t78QrwTA5-clerk-shared-v4-25-3-aborts-hung-fapi-requests-during-load-preventing-indefinite) introduce timeouts for Frontend API requests during load — if the FAPI is slow or unreachable, the client aborts the hung request and renders identity from a freshly minted session token in seconds instead of hanging while retries run. The same fix also prevents `useUser()` from retaining a cookie-derived stub user after full user data arrives. For Vercel customers, [@clerk/backend v3.11.6](/release/rel_-4bXJ3EtplXCWYU9dx0-c-clerk-javascript-sdk-clerk-backend-3-11-6-adds-auto-proxy-opt-out-for-vercel) and the [Next.js SDK](/release/rel_ED-X4dwBmOnismC5va2FL-clerk-next-js-sdk-v7-5-19-adds-opt-out-flag-for-automatic-frontend-api-proxying) add `CLERK_DISABLE_AUTO_PROXY=true` to opt out of automatic Frontend API proxying on production deployments.

Elsewhere, [Clerk Expo v3.7.7](/release/rel_G255ttTNorsUhsFCneXkD-clerk-expo-3-7-7-fixes-android-ui-component-crashes-and-duplicate-init-requests) fixes Android native UI component crashes after navigation detaches and reattaches, and [Clerk UI v1.25.5](/release/rel_0Yy7qikDK0uT_rhy_X8uV-clerk-ui-1-25-5-fixes-escape-key-behavior-in-drawer-and-improves-select) fixes Escape key behavior in the Drawer component. The [Clerk iOS SDK](/release/rel_y-NHUx6k_DN7Q3g7Wr1CX-clerk-ios-sdk-1-3-2-adds-cross-app-sync) adds cross-app sync support, and [Supabase Auth](/release/rel__PRgIv7qjAyLbGPlSR26s-supabase-auth-v2-193-0-links-provider-domains-and-downgrades-session-aal-on) introduces experimental provider linking-domain groups while downgrading session AAL after admin deletion of MFA factors. The [Auth0 dashboard](/release/rel_CAy09hV7po4YWXqHFa53G-auth0-dashboard-adds-role-search-in-public-beta) now supports real-time Role search by ID and name in public beta.

## Releases covered

### Auth0

- [Auth0 dashboard adds Role search in public beta](https://releases.sh/release/rel_CAy09hV7po4YWXqHFa53G-dashboard-now-searches-roles-by-id-and-name-in-real-time)

### Clerk

- [Clerk JavaScript SDK patch escapes SSR script tags to prevent stored XSS](https://releases.sh/release/rel_jhqhjKS9pRx6_L4kda9DL-ssr-script-tags-escape-and-to-prevent-xss)
- [@clerk/tanstack-react-start@1.4.20 patches stored XSS via session claim in SSR script tag](https://releases.sh/release/rel_1aIV1eYBWbUDmHhdekQnC-stored-xss-via-session-claim-in-ssr-script-tag-fixed)
- [Clerk Astro v3.4.19 fixes stored XSS via serialized session claims](https://releases.sh/release/rel_RnkuXrEyHdosoCdY7MTNO-stored-xss-via-session-claims-fixed-initialization-hardened)
- [Clerk Electron v0.0.16 validates IPC origin to prevent token theft from subframes](https://releases.sh/release/rel_WachTvo3yRoOYNfgAQyks-ipc-requests-validated-against-subframe-token-theft)
- [@clerk/backend v3.11.7 rejects machine tokens in __session cookie](https://releases.sh/release/rel_sPLWntZmHusWVnIcxnVFB-machine-tokens-in-session-cookie-now-rejected)
- [Clerk to phase out CBC cipher suites on subdomains by January 2027](https://releases.sh/release/rel_srvTGeYmkCHq6i_vnk7yg-cbc-cipher-suites-deprecated-on-clerk-managed-subdomains)
- [Clerk JS SDK 6.25.3 fails fast on slow FAPI, prevents load hang](https://releases.sh/release/rel_-9PCDim4uk6M0pMV6izcm-slow-fapi-no-longer-hangs-clerk-load-on-startup)
- [@clerk/shared v4.25.3 aborts hung FAPI requests during load, preventing indefinite hangs](https://releases.sh/release/rel_q8DmuwFGHBO-t78QrwTA5-clerk-shared-v4-25-3-aborts-hung-fapi-requests-during-load-preventing-indefinite)
- [Clerk JavaScript SDK @clerk/backend@3.11.6 adds auto-proxy opt-out for Vercel](https://releases.sh/release/rel_-4bXJ3EtplXCWYU9dx0-c-clerk-disable-auto-proxy-skips-vercel-frontend-api-proxying)
- [Clerk Next.js SDK v7.5.19 adds opt-out flag for automatic Frontend API proxying on Vercel](https://releases.sh/release/rel_ED-X4dwBmOnismC5va2FL-auto-frontend-api-proxying-on-vercel-now-opt-out-via-env-flag)
- [@clerk/expo@3.7.7 fixes Android UI component crashes and duplicate init requests](https://releases.sh/release/rel_G255ttTNorsUhsFCneXkD-android-ui-components-survive-navigation-duplicate-inits-prevented)
- [@clerk/ui 1.25.5 fixes Escape key behavior in Drawer and improves Select accessibility](https://releases.sh/release/rel_0Yy7qikDK0uT_rhy_X8uV-escape-key-in-drawer-select-no-longer-dismisses-entire-drawer-select)
- [Clerk iOS SDK 1.3.2 adds cross-app sync](https://releases.sh/release/rel_y-NHUx6k_DN7Q3g7Wr1CX-cross-app-sync-added)

### Supabase

- [Supabase Auth v2.193.0 links provider domains and downgrades session AAL on factor deletion](https://releases.sh/release/rel__PRgIv7qjAyLbGPlSR26s-provider-linking-domain-groups-session-aal-downgraded-after-factor-deletion)