Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Summary

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1

Timeline

1. Apr 24, 2026, 9:04 PM UTCCVE published
2. Apr 27, 2026, 1:46 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Apr 27, 2026, 1:46 PM UTCRecord last updated

Affected versions

• clerk astro

  From 0.0.1 · fixed in 1.5.7; From 2.0.0-snapshot.v20241206174604 · through 2.17.9; From 3.0.0 · fixed in 3.0.15

• clerk nextjs

  From 5.0.0 · fixed in 5.7.6; From 6.0.0-snapshot.vb87a27f · fixed in 6.39.2; From 7.0.0 · fixed in 7.2.1

• clerk nuxt

  From 1.1.0 · fixed in 1.13.28; From 2.0.0 · fixed in 2.2.2

• clerk shared

  From 2.20.17 · fixed in 2.22.1; From 3.0.0-canary.v20250225091530 · fixed in 3.47.4; From 4.0.0 · fixed in 4.8.1

• @clerk/nextjsnpm

  From 5.0.0 · fixed in 5.7.6

• @clerk/nuxtnpm

  From 1.1.0 · fixed in 1.13.28

• @clerk/astronpm

  From 0.0.1 · fixed in 1.5.7

• @clerk/sharednpm

  From 2.20.17 · fixed in 2.22.1

• @clerk/nextjsnpm

  From 6.0.0-snapshot.vb87a27f · fixed in 6.39.2

• @clerk/nextjsnpm

  From 7.0.0 · fixed in 7.2.1

• @clerk/nuxtnpm

  From 2.0.0 · fixed in 2.2.2

• @clerk/astronpm

  From 2.0.0-snapshot.v20241206174604 · fixed in 2.17.10

• @clerk/astronpm

  From 3.0.0 · fixed in 3.0.15

• @clerk/sharednpm

  From 3.0.0-canary.v20250225091530 · fixed in 3.47.4

• @clerk/sharednpm

  From 4.0.0 · fixed in 4.8.1

References 1