Cloudanix VulnDB

CVE-2026-41248

Critical · 9.1

CVSS

9.1

EPSS

0.5%

Published

Apr 24, 2026

CISA due date

—

The record

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1

Affected packages

Ecosystem Package Introduced Fixed
npm @clerk/astro 0.0.1 1.5.7
npm @clerk/astro 2.0.0-snapshot.v20241206174604 2.17.10
npm @clerk/astro 3.0.0 3.0.15
npm @clerk/nextjs 5.0.0 5.7.6
npm @clerk/nextjs 6.0.0-snapshot.vb87a27f 6.39.2
npm @clerk/nextjs 7.0.0 7.2.1
npm @clerk/nuxt 1.1.0 1.13.28
npm @clerk/nuxt 2.0.0 2.2.2
npm @clerk/shared 2.20.17 2.22.1
npm @clerk/shared 3.0.0-canary.v20250225091530 3.47.4
npm @clerk/shared 4.0.0 4.8.1

Related vulnerabilities