CVE-2026-41248 - Vulnerability Analysis

Overview

Clerk JavaScript @clerk/nextjs, @clerk/nuxt, and @clerk/astro contain an authentication bypass caused by crafted requests bypassing createRouteMatcher middleware gating, letting attackers skip middleware and reach downstream handlers, exploit requires crafted requests.

Severity & Score

Impact

Attackers can bypass middleware authentication, potentially accessing protected resources without authorization.

Mitigation

Update to @clerk/astro 1.5.7, 2.17.10, 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, 7.2.1; @clerk/nuxt 1.13.28, 2.2.2; and @clerk/shared 2.22.1, 3.47.4, 4.8.1 or later.

References

• https://github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner