CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass

[
  {
    "vendor": "clerk",
    "product": "astro",
    "versions": [
      {
        "version": ">= 0.0.1, < 1.5.7",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0-snapshot.v20241206174604, <= 2.17.9",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0, < 3.0.15",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "clerk",
    "product": "nextjs",
    "versions": [
      {
        "version": ">= 5.0.0, < 5.7.6",
        "status": "affected"
      },
      {
        "version": ">= 6.0.0-snapshot.vb87a27f, < 6.39.2",
        "status": "affected"
      },
      {
        "version": ">= 7.0.0, < 7.2.1",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "clerk",
    "product": "nuxt",
    "versions": [
      {
        "version": ">= 1.1.0, < 1.13.28",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.2.2",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "clerk",
    "product": "shared",
    "versions": [
      {
        "version": ">= 2.20.17, < 2.22.1",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0-canary.v20250225091530, < 3.47.4",
        "status": "affected"
      },
      {
        "version": ">= 4.0.0, < 4.8.1",
        "status": "affected"
      }
    ]
  }
]