CVE-2026-41248
Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1
- CVSS 3.1
- 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-26)
- CWEs
- CWE-436, CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vqx2-fgx2-5wq9 | npm | @clerk/nextjs | >=5.0.0 <5.7.6 | 5.7.6 |
| GHSA-vqx2-fgx2-5wq9 | npm | @clerk/nuxt | >=1.1.0 <1.13.28 | 1.13.28 |
| GHSA-vqx2-fgx2-5wq9 | npm | @clerk/astro | >=0.0.1 <1.5.7 | 1.5.7 |
| GHSA-vqx2-fgx2-5wq9 | npm | @clerk/shared | >=2.20.17 <2.22.1 | 2.22.1 |
| GHSA-vqx2-fgx2-5wq9 | npm | @clerk/nextjs | >=6.0.0-snapshot.vb87a27f <6.39.2 | 6.39.2 |
| GHSA-vqx2-fgx2-5wq9 | npm | @clerk/nextjs | >=7.0.0 <7.2.1 | 7.2.1 |
| GHSA-vqx2-fgx2-5wq9 | npm | @clerk/nuxt | >=2.0.0 <2.2.2 | 2.2.2 |
| GHSA-vqx2-fgx2-5wq9 | npm | @clerk/astro | >=2.0.0-snapshot.v20241206174604 <2.17.10 | 2.17.10 |
| GHSA-vqx2-fgx2-5wq9 | npm | @clerk/astro | >=3.0.0 <3.0.15 | 3.0.15 |
| GHSA-vqx2-fgx2-5wq9 | npm | @clerk/shared | >=3.0.0-canary.v20250225091530 <3.47.4 | 3.47.4 |
| GHSA-vqx2-fgx2-5wq9 | npm | @clerk/shared | >=4.0.0 <4.8.1 | 4.8.1 |