CVE-2026-41248

🗓️ 24 Apr 2026 21:04:35Reported by GitHub_MType

CVE-2026-41248: Crafted requests bypass Clerk middleware route protection in JavaScript SDKs; fixes.

Reporter	Title	Published	Views	Family All 25
ATTACKERKB	CVE-2026-41248	24 Apr 202621:04	–	attackerkb
Circl	CVE-2026-41248	24 Apr 202622:00	–	circl
CNNVD	Official Clerk JavaScript SDKs 安全漏洞	24 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass	24 Apr 202621:04	–	cvelist
EUVD	EUVD-2026-25632	24 Apr 202621:04	–	euvd
Github Security Blog	Official Clerk JavaScript SDKs: Middleware-based route protection bypass	16 Apr 202621:28	–	github
NVD	CVE-2026-41248	24 Apr 202621:16	–	nvd
OSV	GHSA-VQX2-FGX2-5WQ9 Official Clerk JavaScript SDKs: Middleware-based route protection bypass	16 Apr 202621:28	–	osv
Positive Technologies	PT-2026-35082	16 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-41248	27 Apr 202619:23	–	redhatcve

Vulners

Node

clerk astroRange0.0.1–1.5.7

clerk astroRange2.0.0-snapshot.v20241206174604–2.17.9

clerk astroRange3.0.0–3.0.15

clerk nextjsRange5.0.0–5.7.6

clerk nextjsRange6.0.0-snapshot.vb87a27f–6.39.2

clerk nextjsRange7.0.0–7.2.1

clerk nuxtRange1.1.0–1.13.28

clerk nuxtRange2.0.0–2.2.2

clerk clerk/sharedRange2.20.17–2.22.1

clerk clerk/sharedRange3.0.0-canary.v20250225091530–3.47.4

clerk clerk/sharedRange4.0.0–4.8.1

[
  {
    "vendor": "clerk",
    "product": "astro",
    "versions": [
      {
        "version": ">= 0.0.1, < 1.5.7",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0-snapshot.v20241206174604, <= 2.17.9",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0, < 3.0.15",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "clerk",
    "product": "nextjs",
    "versions": [
      {
        "version": ">= 5.0.0, < 5.7.6",
        "status": "affected"
      },
      {
        "version": ">= 6.0.0-snapshot.vb87a27f, < 6.39.2",
        "status": "affected"
      },
      {
        "version": ">= 7.0.0, < 7.2.1",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "clerk",
    "product": "nuxt",
    "versions": [
      {
        "version": ">= 1.1.0, < 1.13.28",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.2.2",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "clerk",
    "product": "shared",
    "versions": [
      {
        "version": ">= 2.20.17, < 2.22.1",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0-canary.v20250225091530, < 3.47.4",
        "status": "affected"
      },
      {
        "version": ">= 4.0.0, < 4.8.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9

29 Apr 2026 20:56Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.19.1

EPSS0.00096

SSVC