CVE-2026-41248: Official Clerk JavaScript SDKs: Middleware-based route protection bypass

April 16, 2026 (updated April 27, 2026)

createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers.

Sessions are not compromised and no existing user can be impersonated - the bypass only affects the middleware-level gating decision.

References

github.com/advisories/GHSA-vqx2-fgx2-5wq9
github.com/clerk/javascript
github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9
nvd.nist.gov/vuln/detail/CVE-2026-41248

Code Behaviors & Features

Detect and mitigate CVE-2026-41248 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →