Ghsa-Vqx2-Fgx2-5wq9

vulnerability 2026-04-25
Clerk CVE-2026-41248: createRouteMatcher Bypass Skips Middleware Gating Across Next.js, Nuxt, and Astro
Crafted requests slip past createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro, bypassing middleware-level route protection. Patches landed across three major version branches per SDK on April 24.
clerk authentication nextjs nuxt astro middleware-bypass cve-2026-41248 ghsa-vqx2-fgx2-5wq9

Clerk CVE-2026-41248: createRouteMatcher Bypass Skips Middleware Gating Across Next.js, Nuxt, and Astro