CVE-2026-41248 - Vulnerability Analysis

Overview

Clerk JavaScript @clerk/nextjs, @clerk/nuxt, and @clerk/astro contain an authentication bypass caused by crafted requests bypassing createRouteMatcher middleware gating, letting attackers skip middleware and reach downstream handlers, exploit requires crafted requests.

Severity & Score

Impact

Attackers can bypass middleware authentication, potentially accessing protected resources without authorization.

Mitigation

Update to @clerk/astro 1.5.7, 2.17.10, 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, 7.2.1; @clerk/nuxt 1.13.28, 2.2.2; and @clerk/shared 2.22.1, 3.47.4, 4.8.1 or later.

References

• https://github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9

Social Media Activity(1 post)

OffSequence

@offseq

Apr 25, 2026

🚨 CRITICAL: CVE-2026-41248 affects clerk astro, nextjs, nuxt — lets attackers bypass middleware in affected JS libs. Update to fixed versions ASAP to prevent unauthorized access. Patches available now. https://radar.offseq.com/threat/cve-2026-41248-cwe-436-interpretation-conflict-in--1e1431c1 #OffSeq #Vulnerability #ClerkJS

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner