CVE-2026-41248 Details
Description
Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1
A vulnerability exists in the Clerk JavaScript libraries for Astro, Next.js, and Nuxt, where the `createRouteMatcher` function can be bypassed by specially crafted requests. This allows requests to skip middleware protections and directly access downstream handlers, such as API routes or server components. While this vulnerability does not compromise user sessions or authentication, it can undermine route protection by allowing unauthorized access to protected resources.
Users should upgrade to the latest patched versions of the Clerk libraries. For `@clerk/nextjs`, the fixed versions are 5.7.6, 6.39.2, and 7.2.1. For `@clerk/nuxt`, users should upgrade to 1.13.28 or 2.2.2. For `@clerk/astro`, the patched versions are 1.5.7, 2.17.10, and 3.0.15. If an immediate upgrade is not possible, adding server-side authentication checks in route handlers can provide temporary protection against the bypass.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 24, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| @clerk/astro | All versions |
CPE
Remediation
| |
| @clerk/nextjs | All versions |
CPE
Remediation
| |
| @clerk/nuxt | All versions |
CPE
Remediation
| |
| @clerk/shared | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |