Read the docs
TI-2026-29857 Aliases CVE-2026-41248GHSA-vqx2-fgx2-5wq9

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Priority MEDIUM 41CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00323 25th percentileScored 2026-11-07
Fix Fixed astro (clerk): 1.5.7, 3.0.15nextjs (clerk): 5.7.6, 6.39.2, 7.2.1+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
clerkastro0.0.1 to before 1.5.7; 2.0.0-snapshot.v20241206174604 – 2.17.9; 3.0.0 to before 3.0.151.5.7, 3.0.15Patch availableCNA
clerknextjs5.0.0 to before 5.7.6; 6.0.0-snapshot.vb87a27f to before 6.39.2; 7.0.0 to before 7.2.15.7.6, 6.39.2, 7.2.1Patch availableCNA
clerknuxt1.1.0 to before 1.13.28; 2.0.0 to before 2.2.21.13.28, 2.2.2Patch availableCNA
clerkshared2.20.17 to before 2.22.1; 3.0.0-canary.v20250225091530 to before 3.47.4; 4.0.0 to before 4.8.12.22.1, 3.47.4, 4.8.1Patch availableCNA
—@clerk/nextjs (npm)5.0.0 to before 5.7.65.7.6Patch availableGHSA-vqx2-fgx2-5wq9
—@clerk/nuxt (npm)1.1.0 to before 1.13.281.13.28Patch availableGHSA-vqx2-fgx2-5wq9
—@clerk/astro (npm)0.0.1 to before 1.5.71.5.7Patch availableGHSA-vqx2-fgx2-5wq9
—@clerk/shared (npm)2.20.17 to before 2.22.12.22.1Patch availableGHSA-vqx2-fgx2-5wq9
—@clerk/nextjs (npm)6.0.0-snapshot.vb87a27f to before 6.39.26.39.2Patch availableGHSA-vqx2-fgx2-5wq9
—@clerk/nextjs (npm)7.0.0 to before 7.2.17.2.1Patch availableGHSA-vqx2-fgx2-5wq9
—@clerk/nuxt (npm)2.0.0 to before 2.2.22.2.2Patch availableGHSA-vqx2-fgx2-5wq9
—@clerk/astro (npm)2.0.0-snapshot.v20241206174604 to before 2.17.102.17.10Patch availableGHSA-vqx2-fgx2-5wq9
—@clerk/astro (npm)3.0.0 to before 3.0.153.0.15Patch availableGHSA-vqx2-fgx2-5wq9
—@clerk/shared (npm)3.0.0-canary.v20250225091530 to before 3.47.43.47.4Patch availableGHSA-vqx2-fgx2-5wq9
—@clerk/shared (npm)4.0.0 to before 4.8.14.8.1Patch availableGHSA-vqx2-fgx2-5wq9
  • astro Vendorclerk Affected 0.0.1 to before 1.5.7; 2.0.0-snapshot.v20241206174604 – 2.17.9; 3.0.0 to before 3.0.15 Fixed in 1.5.7, 3.0.15 Patch available CNA
  • nextjs Vendorclerk Affected 5.0.0 to before 5.7.6; 6.0.0-snapshot.vb87a27f to before 6.39.2; 7.0.0 to before 7.2.1 Fixed in 5.7.6, 6.39.2, 7.2.1 Patch available CNA
  • nuxt Vendorclerk Affected 1.1.0 to before 1.13.28; 2.0.0 to before 2.2.2 Fixed in 1.13.28, 2.2.2 Patch available CNA
  • shared Vendorclerk Affected 2.20.17 to before 2.22.1; 3.0.0-canary.v20250225091530 to before 3.47.4; 4.0.0 to before 4.8.1 Fixed in 2.22.1, 3.47.4, 4.8.1 Patch available CNA
  • @clerk/nextjs (npm) Vendor— Affected 5.0.0 to before 5.7.6 Fixed in 5.7.6 Patch available GHSA-vqx2-fgx2-5wq9
  • @clerk/nuxt (npm) Vendor— Affected 1.1.0 to before 1.13.28 Fixed in 1.13.28 Patch available GHSA-vqx2-fgx2-5wq9
  • @clerk/astro (npm) Vendor— Affected 0.0.1 to before 1.5.7 Fixed in 1.5.7 Patch available GHSA-vqx2-fgx2-5wq9
  • @clerk/shared (npm) Vendor— Affected 2.20.17 to before 2.22.1 Fixed in 2.22.1 Patch available GHSA-vqx2-fgx2-5wq9
  • @clerk/nextjs (npm) Vendor— Affected 6.0.0-snapshot.vb87a27f to before 6.39.2 Fixed in 6.39.2 Patch available GHSA-vqx2-fgx2-5wq9
  • @clerk/nextjs (npm) Vendor— Affected 7.0.0 to before 7.2.1 Fixed in 7.2.1 Patch available GHSA-vqx2-fgx2-5wq9
  • @clerk/nuxt (npm) Vendor— Affected 2.0.0 to before 2.2.2 Fixed in 2.2.2 Patch available GHSA-vqx2-fgx2-5wq9
  • @clerk/astro (npm) Vendor— Affected 2.0.0-snapshot.v20241206174604 to before 2.17.10 Fixed in 2.17.10 Patch available GHSA-vqx2-fgx2-5wq9
  • @clerk/astro (npm) Vendor— Affected 3.0.0 to before 3.0.15 Fixed in 3.0.15 Patch available GHSA-vqx2-fgx2-5wq9
  • @clerk/shared (npm) Vendor— Affected 3.0.0-canary.v20250225091530 to before 3.47.4 Fixed in 3.47.4 Patch available GHSA-vqx2-fgx2-5wq9
  • @clerk/shared (npm) Vendor— Affected 4.0.0 to before 4.8.1 Fixed in 4.8.1 Patch available GHSA-vqx2-fgx2-5wq9

Remediation

  • Fix · CNA astro (clerk) Fixed in 1.5.7, 3.0.15
  • Fix · CNA nextjs (clerk) Fixed in 5.7.6, 6.39.2, 7.2.1
  • Fix · CNA nuxt (clerk) Fixed in 1.13.28, 2.2.2
  • Fix · CNA shared (clerk) Fixed in 2.22.1, 3.47.4, 4.8.1
  • Fix · GHSA-vqx2-fgx2-5wq9 @clerk/nextjs (npm) Fixed in 5.7.6 Advisory →
  • Fix · GHSA-vqx2-fgx2-5wq9 @clerk/nuxt (npm) Fixed in 1.13.28 Advisory →
  • Fix · GHSA-vqx2-fgx2-5wq9 @clerk/astro (npm) Fixed in 1.5.7 Advisory →
  • Fix · GHSA-vqx2-fgx2-5wq9 @clerk/shared (npm) Fixed in 2.22.1 Advisory →
  • Fix · GHSA-vqx2-fgx2-5wq9 @clerk/nextjs (npm) Fixed in 6.39.2 Advisory →
  • Fix · GHSA-vqx2-fgx2-5wq9 @clerk/nextjs (npm) Fixed in 7.2.1 Advisory →
  • Fix · GHSA-vqx2-fgx2-5wq9 @clerk/nuxt (npm) Fixed in 2.2.2 Advisory →
  • Fix · GHSA-vqx2-fgx2-5wq9 @clerk/astro (npm) Fixed in 2.17.10 Advisory →
  • Fix · GHSA-vqx2-fgx2-5wq9 @clerk/astro (npm) Fixed in 3.0.15 Advisory →
  • Fix · GHSA-vqx2-fgx2-5wq9 @clerk/shared (npm) Fixed in 3.47.4 Advisory →
  • Fix · GHSA-vqx2-fgx2-5wq9 @clerk/shared (npm) Fixed in 4.8.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41248
  2. 2026-10-03 Alias added: GHSA-vqx2-fgx2-5wq9

References

Advisory 1

Other 2

  • TI-2026-30651 Clerk: Authorization bypass when combining organization, billing, or reverification checks CVSS 4.0HIGH 7.6
  • TI-2024-14799 @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) CVSS 3.1CRITICAL 9.8
  • TI-2025-33492 @clerk/backend Performs Insufficient Verification of Data Authenticity CVSS 3.1HIGH 7.5
  • TI-2026-26399 Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host CVSS 3.1HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences