Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2026-41248

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1

VectorNETWORK

PublishedApr 24, 2026, 21:16

Published Bysecurity-advisories@github.com

Base Score

Score9.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

@clerk/nextjs(npm)5.0.05.7.6N/A

@clerk/nuxt(npm)1.1.01.13.28N/A

@clerk/astro(npm)0.0.11.5.7N/A

@clerk/shared(npm)2.20.172.22.1N/A

@clerk/nextjs(npm)6.0.0-snapshot.vb87a27f6.39.2N/A

@clerk/nextjs(npm)7.0.07.2.1N/A

@clerk/nuxt(npm)2.0.02.2.2N/A

@clerk/astro(npm)2.0.0-snapshot.v202412061746042.17.10N/A

@clerk/astro(npm)3.0.03.0.15N/A

@clerk/shared(npm)3.0.0-canary.v202502250915303.47.4N/A

@clerk/shared(npm)4.0.04.8.1N/A

References

https://github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9

Weakness Type

CWE-436

CVSS Metrics

Base Score

9.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK