Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/nextjs

Description

createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers.

Sessions are not compromised and no existing user can be impersonated - the bypass only affects the middleware-level gating decision.

Recommendation

Update the @clerk/nextjs package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 7.0.0, < 7.2.1

  >= 6.0.0-snapshot.vb87a27f, < 6.39.2

  >= 5.0.0, < 5.7.6**

• Patched version(s): **7.2.1

  6.39.2

  5.7.6**

References

• GHSA-vqx2-fgx2-5wq9
• CVE-2026-41248
• CWE-436
• CWE-863
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/astro - CVE-2026-41248
• Official Clerk JavaScript SDKs: Middleware-based route protection bypass - CVE-2026-41248
• Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/shared - CVE-2026-41248
• Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/nextjs - CVE-2026-42349

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Tags:

npm

@clerk/nextjs