CVE Intelligence
Analysis AI-assisted

CVE-2026-41248: Clerk JavaScript SDKs: createRouteMatcher middleware bypass

CVE-2026-41248 is a critical issue in the Clerk JavaScript SDKs, where createRouteMatcher in @clerk/nextjs, @clerk/nuxt and @clerk/astro can be bypassed by certain crafted requests. A successful bypass lets requests skip middleware gating and reach downstream handlers. The record lists fixed versions for each affected package branch, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Clerk provides authentication for web applications, and its JavaScript SDKs include a route matcher, createRouteMatcher, that middleware uses to decide which pages and endpoints need protection. According to the record, this matcher in @clerk/nextjs, @clerk/nuxt and @clerk/astro can be bypassed by certain crafted requests, so middleware gating is skipped and requests reach downstream handlers. The record classifies the weakness as CWE-436 (Interpretation Conflict).

Impact

  • Requests may reach handlers that the middleware was meant to protect.
  • The record rates the issue critical, with a CVSS 3.1 base score of 9.1 and high confidentiality and integrity impact. Availability impact is listed as none.
  • The real exposure depends on how each application uses the matcher and what its downstream handlers do. The record does not provide this information.

Affected products and versions

The record lists four affected product groups: Clerk Astro, Clerk Nextjs, Clerk Nuxt and Clerk Shared. Fixed versions named in the record are:

  • @clerk/astro: 1.5.7, 2.17.10 and 3.0.15.
  • @clerk/nextjs: 5.7.6, 6.39.2 and 7.2.1.
  • @clerk/nuxt: 1.13.28 and 2.2.2.
  • @clerk/shared: 2.22.1, 3.47.4 and 4.8.1.

The record also gives affected version ranges for each branch, which end below these fixed versions. Consult the GitHub advisory for the complete ranges. Packages in the affected groups that run on the fixed versions are not affected by this issue, according to the record's fixed-version list.

Exploitation status

The record shows that this CVE is not listed in CISA KEV, so there is no confirmed active exploitation to report. The SSVC fields in the record show exploitation as none and automatable as no. The EPSS probability in the record is 0.00529. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify every project that uses @clerk/nextjs, @clerk/nuxt, @clerk/astro or @clerk/shared, including transitive dependencies.
  • Upgrade each package to the fixed version for its branch, as listed above, and confirm the resolved version in lockfiles and deployed builds.
  • Until upgrades are complete, do not rely only on middleware route matching to protect sensitive handlers. Add authorization checks inside downstream handlers as defense in depth.
  • Re-test route protection after upgrading, using only authorized test plans.

Detection guidance

  • Review application and access logs for requests that reached protected handlers without the expected authentication flow, especially in routes that the middleware should gate.
  • Inventory dependency versions across repositories and build pipelines, and flag any Clerk package below its fixed version.
  • Monitor for unexpected changes in response codes or access patterns on sensitive routes after deployment.

Limitations of the available information

  • The record does not describe the form of the crafted requests and does not provide technical details beyond the bypass outcome.
  • No public proof-of-concept or exploitation data is included in the record, so public exploit availability is unknown.
  • The record's source status is listed as Deferred, and its meaning for this analysis is unknown.
  • The EPSS date in the record is 2026-10-13, which should be treated with caution when interpreting the score.
  • The record's @clerk/shared fixed-version list contains a typographical error, so the three fixed versions are read as 2.22.1, 3.47.4 and 4.8.1.

Frequently asked questions

What does CVE-2026-41248 allow?

According to the record, certain crafted requests can bypass createRouteMatcher in @clerk/nextjs, @clerk/nuxt and @clerk/astro, allowing them to skip middleware gating and reach downstream handlers.

Which versions are fixed?

The record lists fixed versions for each branch: @clerk/astro 1.5.7, 2.17.10 and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2 and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4 and 4.8.1.

Is this vulnerability being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.