fix(fastify,express): Respond 400 instead of 500 to requests that cannot be web requests

[wobsoriano]

Description

This PR makes clerkPlugin (fastify) and clerkMiddleware (express) respond 400 Bad Request instead of 500 to requests that cannot be converted into a fetch Request. Node's HTTP parser accepts vulnerability-scanner probes such as hostless GET // targets, targets that parse as credentialed URLs, and TRACE requests, but the middleware's unguarded new URL() / new Request() calls threw on them, surfacing 500s and error-log noise where a bare app answers 404.

400 is the status for a request the server cannot process due to a client error such as malformed syntax (RFC 9110 §15.5.1), and it matches what Node and Fastify already return for the same class of input caught at their own layer. The guard also covers the Frontend API proxy branches, and the exported authenticateRequest helper is unchanged apart from an optional prebuilt clerkRequest param that avoids converting twice.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[changeset-bot]

🦋 Changeset detected

Latest commit: 01d4695

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@clerk/fastify	Patch
@clerk/express	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview	Jul 30, 2026 7:59pm
swingset	Ready	Preview	Jul 30, 2026 7:59pm

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9290

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9290

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9290

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9290

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9290

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9290

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9290

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9290

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9290

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9290

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9290

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9290

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9290

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9290

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9290

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9290

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9290

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9290

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9290

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9290

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9290

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9290

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9290

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9290

commit: 01d4695

[github-actions]

API Changes Report

Generated by Break Check on 2026-07-30T20:02:36.851Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	1
🔴 Breaking changes	0
🟡 Non-breaking changes	1
🟢 Additions	0

🤖 This report was reviewed by claude-sonnet-4-6.

---

@clerk/express

Current version: 2.1.48
Recommended bump: MINOR → 2.2.0

Subpath ./types

🟡 Non-breaking Changes (1)

Modified: AuthenticateRequestParams

  type AuthenticateRequestParams = {
    clerkClient: ClerkClient$1;
    request: Request;
-   options?: ClerkMiddlewareOptions;
+   options?: ClerkMiddlewareOptions; /** Prebuilt ClerkRequest, so callers that already converted the request can skip re-conversion. */
+   clerkRequest?: ClerkRequest;
  };

Static analyzer: Breaking change in type alias AuthenticateRequestParams: Type changed: {clerkClient:import("@clerk/express").~ClerkClient$1;request:import("@types/express").e.Request;options?:import("@clerk… → {clerkClient:import("@clerk/express").~ClerkClient$1;request:import("@types/express").e.Request;options?:import("@clerk…

🤖 AI review (reclassified as non-breaking) (95%): The change only adds a new optional property clerkRequest? to AuthenticateRequestParams; existing consumers who construct this type need not provide it, and the type appears to be used as an input/parameter type where adding an optional field is non-breaking.

---

Report generated by Break Check

_{Last ran on 01d4695.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 00097325-ae6a-4796-9d6e-42308d5b788d

📥 Commits

Reviewing files that changed from the base of the PR and between fe6ee54 and 2db65e3.

📒 Files selected for processing (7)

• .changeset/harden-request-conversion.md
• packages/express/src/__tests__/clerkMiddleware.test.ts
• packages/express/src/authenticateRequest.ts
• packages/express/src/types.ts
• packages/fastify/src/__tests__/frontendApiProxy.test.ts
• packages/fastify/src/__tests__/withClerkMiddleware.test.ts
• packages/fastify/src/withClerkMiddleware.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)
• clerk/clerk-ios (auto-detected)
• clerk/clerk-android (auto-detected)
• clerk/cli (auto-detected)

---

📝 Walkthrough

Walkthrough

Express and Fastify middleware now return HTTP 400 when request URLs, targets, methods, or proxy conversions cannot produce Fetch requests. Express can reuse a prebuilt ClerkRequest during authentication. Tests cover invalid targets, hostless targets, credentialed URL-like inputs, TRACE, and proxy bypass behavior. A changeset records patch releases for both packages.

Estimated code review effort: 3 (Moderate) | ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title concisely summarizes the main change: returning 400 for requests that cannot be converted into web requests.
Description check	✅ Passed	The description accurately describes the Fastify and Express 400-handling changes and the optional clerkRequest tweak.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

---

_{Comment @coderabbitai help to get the list of available commands.}