Documents
- Federal: Is there a ClickHouse version that is secured for US Federal compliance?
ClickHouse Response to the Axios npm Supply Chain Compromise
ClickHouse Cloud is not impacted by the recently disclosed supply chain attack against the Axios npm package (axios@1.14.1 and axios@0.30.4), in which a compromised maintainer account was used to publish backdoored versions containing a cross-platform remote access trojan (RAT). No action is required by our customers.
ClickHouse Response to React (CVE-2025-55182) and Next.js (CVE-2025-66478) vulnerabilities
ClickHouse Cloud is not impacted by the recently published vulnerabilities affecting React (CVE-2025-55182) and Next.js (CVE-2025-66478). Our security team has completed a thorough investigation and confirmed that our platform does not utilize the specific React Server Components (RSC) configurations required for exploitation. No action is required by our customers.
ClickHouse Response to Shai-Hulud 2.0 Supply Chain Attacks
ClickHouse is not affected by the Shai-Hulud 2.0 npm supply chain attack. Our security team has audited our software supply chain and confirmed that our products and infrastructure remain secure. We continue to monitor the situation to ensure ongoing protection for our customers.