This vulnerability involves an interpretation conflict (CWE-436) and improper authorization (CWE-863) in the createRouteMatcher function of Clerk JavaScript authentication libraries. It allows attackers to bypass middleware protections by sending specially crafted requests, thereby reaching downstream handlers without proper gating. Affected versions include @clerk/astro versions prior to 1.5.7, 2.0.0-snapshot through 2.17.9, and 3.0.0 through 3.0.14. The issue is resolved in @clerk/astro 1.5.7, 2.17.10, and 3.0.15, as well as in corresponding patched versions of @clerk/nextjs, @clerk/nuxt, and @clerk/shared.

Successful exploitation allows an attacker to bypass middleware security controls, potentially leading to unauthorized access to protected routes or resources. The vulnerability has a high impact on confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

A fix is available and has been released in the following versions: @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, and 4.8.1. Users should upgrade to these or later versions to remediate the vulnerability. Patch status is confirmed by the vendor advisory embedded in the description. No additional mitigation steps are indicated.