# CVE-2026-41248: Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Source: https://junglewise.ai/threats/cve-2026-41248-official-clerk-javascript-sdks-middleware-based-route-protection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-41248 · Severity: critical · CVSS 9.1 · Published 2026-04-24

Clerk's JavaScript authentication libraries for Next.js, Nuxt, and Astro contain a flaw in their createRouteMatcher function that allows attackers to craft malicious requests to bypass middleware-level route protection and access protected endpoints without authentication. While sessions remain secure and no existing users can be impersonated, this enables unauthorized access to protected API routes and server components that rely solely on middleware gating. Organizations using these SDKs should upgrade immediately to patched versions to prevent unauthorized access to protected features and data.

Technologies: [@clerk/astro (npm)](https://junglewise.ai/threats/technologies/clerk-astro), [@clerk/nextjs (npm)](https://junglewise.ai/threats/technologies/clerk-nextjs), [@clerk/nuxt (npm)](https://junglewise.ai/threats/technologies/clerk-nuxt). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-41248 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41248 being exploited in the wild.

**How severe is CVE-2026-41248?** Critical severity, with a CVSS score of 9.1, published 24 April 2026.

**Which products and versions are affected?** @clerk/astro (npm) SEMVER:introduced=0.0.1,fixed=1.5.7; @clerk/nextjs (npm) SEMVER:introduced=5.0.0,fixed=5.7.6; @clerk/nuxt (npm) SEMVER:introduced=1.1.0,fixed=1.13.28; @clerk/shared (npm) SEMVER:introduced=2.20.17,fixed=2.22.1.

**Is there a fix for CVE-2026-41248?** Yes. @clerk/astro (npm): upgrade to 1.5.7 or later; @clerk/nextjs (npm): upgrade to 5.7.6 or later; @clerk/nuxt (npm): upgrade to 1.13.28 or later; @clerk/shared (npm): upgrade to 2.22.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41248 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-41248?** Check whether you run @clerk/astro (npm), @clerk/nextjs (npm), @clerk/nuxt (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @clerk/astro (npm): upgrade to 1.5.7 or later

  ```sh
  npm install @clerk/astro@1.5.7
  ```

- @clerk/nextjs (npm): upgrade to 5.7.6 or later

  ```sh
  npm install @clerk/nextjs@5.7.6
  ```

- @clerk/nuxt (npm): upgrade to 1.13.28 or later

  ```sh
  npm install @clerk/nuxt@1.13.28
  ```

- @clerk/shared (npm): upgrade to 2.22.1 or later

  ```sh
  npm install @clerk/shared@2.22.1
  ```


## Technical details

The vulnerability exists in the createRouteMatcher function across @clerk/nextjs, @clerk/nuxt, and @clerk/astro SDKs, which can be bypassed via specially crafted HTTP requests that don't match expected patterns. The root cause lies in the route-matching logic used by clerkMiddleware to determine whether to enforce authentication. An unauthenticated attacker on the network can send malicious requests that circumvent the middleware's route-matching decision and reach downstream handlers (API routes, server components, server actions) without triggering the auth.protect() call. Critically, this bypass only affects the middleware-level gate decision; the underlying authentication state remains accurate, and auth() calls within route handlers continue to work correctly. The vulnerability can be exploited if an application relies exclusively on middleware-level route gating without additional server-side auth checks. Patches are available across all affected versions (e.g., @clerk/nextjs 5.7.6+, 6.39.2+, 7.2.1+) and are drop-in replacements with no API changes.

## Affected products

- Clerk @clerk/nextjs 5.0.0 to 6.39.1, 7.0.0 to 7.2.0
- Clerk @clerk/nuxt 1.1.0 to 1.13.27, 2.0.0 to 2.2.1
- Clerk @clerk/astro 0.0.1 to 2.17.9, 3.0.0 to 3.0.14
- Clerk @clerk/shared 2.20.17 to 3.47.3, 4.0.0 to 4.8.0

## Identifiers

- CVE-2026-41248
- GHSA-vqx2-fgx2-5wq9

## Timeline

- 2026-04-15: disclosed: Publicly disclosed
- 2026-04-15: patched: Patches released for all affected versions

## References

- [https://github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9](https://github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9)

## Related threats

- [Clerk JavaScript SDKs authorization bypass in combined predicates](https://junglewise.ai/threats/cve-2026-42349-clerk-javascript-sdks-authorization-bypass-in-combined-predicates)
- [Clerk webhook verifyWebhook insufficient signature verification](https://junglewise.ai/threats/cve-2025-53548-clerk-webhook-verifywebhook-insufficient-signature-verification)
- [Clerk nextjs auth() and getAuth() IDOR vulnerability](https://junglewise.ai/threats/cve-2024-22206-clerk-nextjs-auth-and-getauth-idor-vulnerability)