{"id":"CVE-2026-41248","aliases":["GHSA-vqx2-fgx2-5wq9"],"url":"https://o3.security/vulnerability/CVE-2026-41248","summary":"Official Clerk JavaScript SDKs:  Middleware-based route protection bypass","details":"Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1","published":"2026-04-24T21:04:35.810Z","modified":"2026-09-02T03:47:27.121825Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":{"score":0.00323,"percentile":0.24925,"asOf":"2026-08-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@clerk/nextjs","fixedVersion":"5.7.6"},{"ecosystem":"npm","name":"@clerk/nuxt","fixedVersion":"1.13.28"},{"ecosystem":"npm","name":"@clerk/astro","fixedVersion":"1.5.7"},{"ecosystem":"npm","name":"@clerk/shared","fixedVersion":"2.22.1"},{"ecosystem":"npm","name":"@clerk/nextjs","fixedVersion":"6.39.2"},{"ecosystem":"npm","name":"@clerk/nextjs","fixedVersion":"7.2.1"},{"ecosystem":"npm","name":"@clerk/nuxt","fixedVersion":"2.2.2"},{"ecosystem":"npm","name":"@clerk/astro","fixedVersion":"2.17.10"},{"ecosystem":"npm","name":"@clerk/astro","fixedVersion":"3.0.15"},{"ecosystem":"npm","name":"@clerk/shared","fixedVersion":"3.47.4"},{"ecosystem":"npm","name":"@clerk/shared","fixedVersion":"4.8.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41248.json"},{"type":"ADVISORY","url":"https://github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41248"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-02T03:47:27.121825Z"}}