Description
createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers.
Sessions are not compromised and no existing user can be impersonated - the bypass only affects the middleware-level gating decision.
Recommendation
Update the @clerk/nextjs package to the latest compatible version. Followings are version details:
Affected version(s): **>= 7.0.0, < 7.2.1 >= 6.0.0-snapshot.vb87a27f, < 6.39.2 >= 5.0.0, < 5.7.6** Patched version(s): **7.2.1 6.39.2 5.7.6**
References
Could your website be exposed too?
SmartScanner can check your website for Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/nextjs and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/astro - CVE-2026-41248
- Official Clerk JavaScript SDKs: Middleware-based route protection bypass - CVE-2026-41248
- Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/shared - CVE-2026-41248
- Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/nextjs - CVE-2026-42349
You might also like:
See something that needs correcting? Let us knowUpdated April 27, 2026