Repository navigation
Bug: <SignUp/> incorrectly formats form_password_matches_identifier as a complexity error. #9478
Description
Preliminary Checks
-
I have reviewed the documentation: https://clerk.com/docs
-
I have searched for existing issues: https://github.com/clerk/javascript/issues
-
I have not already reached out to Clerk support via email or Discord (if you have, no need to open an issue here)
-
This issue is not a question, general help request, or anything other than a bug report directly related to Clerk. Please ask questions in our Discord community: https://clerk.com/discord.
Reproduction
This issue occurs out-of-the-box on any standard Next.js setup using the core component, no special reproduction repository is needed as it relies on the core component's default error handling logic.
Publishable key
pk_test_Z3JhdGVmdWwtaGFyZS04Mi5jbGVyay5hY2NvdW50cy5kZXYk
Description
Description:
When a user attempts to sign up with a password that is identical to their username or email, the backend correctly rejects it with a 422 containing the form_password_matches_identifier code.
However, the component appears to intercept this as a password complexity (zxcvbn) error because meta.param_name === "password". Because this specific API error does not return a meta.requirement field, the component seems to pass undefined to the passwordComplexity localizer.
(If this is intended behavior or a misconfiguration on my end, please let me know!)
Steps to reproduce:
- Mount a standard component on a fresh Next.js install.
- Enter an email address (e.g., test@example.com).
- Enter a password that exactly matches the email address (test@example.com).
- Complete any remaining required fields (e.g., username, legal consent).
- Submit the form.
- Observe the UI error under the password field.
Expected behavior:
I would expect the component to recognize form_password_matches_identifier as a standard form error rather than grouping it under passwordComplexity, and render the unstable__errors.form_password_matches_identifier localization string directly (e.g., "Password cannot be the same as your email.").
Actual behavior:
The component appears to fail to format a complexity requirement, resulting in a glitched UI string built from passwordComplexity.sentencePrefix + "" + ".". The UI renders the error: "Your password must contain ."
Additional context:
While the attached screenshot shows a customized screen using Clerk's appearance props and localization, I have done my best to verify that this glitch is not caused by any of my custom overrides. It seems to be a bug in the core SDK's error mapping for form_password_matches_identifier that occurs even on a completely vanilla component.

Environment
System:
OS: Windows 11 10.0.26200
CPU: (12) x64 AMD Ryzen 5 2600 Six-Core Processor
Memory: 3.00 GB / 15.94 GB
Binaries:
Node: 24.15.0 - C:\Program Files\nodejs\node.EXE
npm: 11.12.1 - C:\Program Files\nodejs\npm.CMD
Browsers:
Chrome: 151.0.7922.138
Edge: Chromium (151.0.4129.86)
npmPackages:
@clerk/nextjs: ^7.5.20 => 7.5.20
@clerk/themes: ^2.4.57 => 2.4.57
@clerk/ui: ^1.25.7 => 1.27.1
next: ^16.2.10 => 16.2.12
react: ^19.2.7 => 19.2.7
react-dom: ^19.2.7 => 19.2.7
Activity
ArjunCodess commentedon Sep 19, 2026
hey,
form_password_matches_identifieris a form error, not a zxcvbn requirement.the component keys off
meta.param_name === "password"and then looks formeta.requirement, which this code doesn't have. hence "Your password must contain ."i'd treat that code as a field error and render
unstable__errors.form_password_matches_identifierdirectly.is there a list of password codes that should skip the complexity formatter? i can add this one and a test for the exact 422.
mikroskato62 commentedon Sep 21, 2026
Hey, thanks for confirming and looking into this!
I took a look at
createPasswordErrorin@clerk/ui/dist/utils/passwordUtils.js(v1.27.1) and it seems like these codes are already handled as direct field errors rather than going through the complexity formatter:form_password_size_in_bytes_exceededform_password_pwnedform_new_password_matches_currentform_password_matches_identifierSo from what I can see, the pattern would be any code where
meta.param_name === "password"butmeta.requirementis absent - though you'd know better than me if there are others on the backend side that I'm not seeing.A regression test for the 422 on
form_password_matches_identifiersounds great!alexcarpenter commentedon Oct 2, 2026
Fixed in #9453, released in @clerk/ui@1.30.4.