CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass
Attackers can bypass middleware route protection in Clerk JavaScript SDKs to access restricted handlers, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41248?
CVE-2026-41248 is a critical authentication bypass vulnerability in clerk astro, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1
Which versions are affected by CVE-2026-41248?
22 open source packages ship an affected version, including @clerk/astro, @clerk/nextjs and @clerk/nuxt.
| Package | Affected | Fixed in |
|---|---|---|
@clerk/astro npm | From 0.0.1 | 1.5.7 |
@clerk/astro npm | From 0.0.1 | 1.5.7 |
@clerk/astro npm | From 2.0.0-snapshot.v20241206174604 | 2.17.10 |
@clerk/astro npm | From 2.0.0-snapshot.v20241206174604 | 2.17.10 |
@clerk/astro npm | From 3.0.0 | 3.0.15 |
@clerk/astro npm | From 3.0.0 | 3.0.15 |
16 more packages
@clerk/nextjs npm | From 5.0.0 | 5.7.6 |
@clerk/nextjs npm | From 5.0.0 | 5.7.6 |
@clerk/nextjs npm | From 6.0.0-snapshot.vb87a27f | 6.39.2 |
@clerk/nextjs npm | From 6.0.0-snapshot.vb87a27f | 6.39.2 |
@clerk/nextjs npm | From 7.0.0 | 7.2.1 |
@clerk/nextjs npm | From 7.0.0 | 7.2.1 |
@clerk/nuxt npm | From 1.1.0 | 1.13.28 |
@clerk/nuxt npm | From 1.1.0 | 1.13.28 |
@clerk/nuxt npm | From 2.0.0 | 2.2.2 |
@clerk/nuxt npm | From 2.0.0 | 2.2.2 |
@clerk/shared npm | From 2.20.17 | 2.22.1 |
@clerk/shared npm | From 2.20.17 | 2.22.1 |
@clerk/shared npm | From 3.0.0-canary.v20250225091530 | 3.47.4 |
@clerk/shared npm | From 3.0.0-canary.v20250225091530 | 3.47.4 |
@clerk/shared npm | From 4.0.0 | 4.8.1 |
@clerk/shared npm | From 4.0.0 | 4.8.1 |
How do I fix CVE-2026-41248?
Upgrade @clerk/astro to a fixed version for your release line: 1.5.7, 2.17.10 or 3.0.15.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-41248 being exploited?
There is no known exploitation of CVE-2026-41248 in the wild and no public exploit code.
Sources
Also known as GHSA-vqx2-fgx2-5wq9.