Official Clerk JavaScript SDKs: Middleware-based route protection bypass

🗓️ 16 Apr 2026 21:28:26Reported by GitHub Advisory DatabaseType

Middleware route matching can be bypassed; upgrade to patched versions; sessions remain secure.

Reporter	Title	Published	Views	Family All 25
ATTACKERKB	CVE-2026-41248	24 Apr 202621:04	–	attackerkb
Circl	CVE-2026-41248	24 Apr 202622:00	–	circl
CNNVD	Official Clerk JavaScript SDKs 安全漏洞	24 Apr 202600:00	–	cnnvd
CVE	CVE-2026-41248	24 Apr 202621:04	–	cve
Cvelist	CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass	24 Apr 202621:04	–	cvelist
EUVD	EUVD-2026-25632	24 Apr 202621:04	–	euvd
NVD	CVE-2026-41248	24 Apr 202621:16	–	nvd
OSV	GHSA-VQX2-FGX2-5WQ9 Official Clerk JavaScript SDKs: Middleware-based route protection bypass	16 Apr 202621:28	–	osv
Positive Technologies	PT-2026-35082	16 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-41248	27 Apr 202619:23	–	redhatcve

Vulners

Node

clerk clerk/sharedRange4.0.0–4.8.1npm

clerk clerk/sharedRange3.0.0-canary.v20250225091530–3.47.4npm

clerk astroRange3.0.0–3.0.15npm

clerk astroRange2.0.0-snapshot.v20241206174604–2.17.9npm

clerk nuxtRange2.0.0–2.2.2npm

clerk nextjsRange7.0.0–7.2.1npm

clerk nextjsRange6.0.0-snapshot.vb87a27f–6.39.2npm

clerk clerk/sharedRange2.20.17–2.22.1npm

clerk astroRange0.0.1–1.5.7npm

clerk nuxtRange1.1.0–1.13.28npm

clerk nextjsRange5.0.0–5.7.6npm

Source	Link
github	www.github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41248
github	www.github.com/advisories/GHSA-vqx2-fgx2-5wq9

27 Apr 2026 16:08Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.1

EPSS0.00323

SSVC