The vulnerability CVE-2026-41248 involves an interpretation conflict in the createRouteMatcher function within Clerk's JavaScript authentication libraries for frameworks including Next.js, Nuxt, and Astro. This flaw permits attackers to craft requests that bypass middleware protections, allowing them to reach downstream handlers without proper authorization. Affected versions span multiple releases before the fixed versions listed. The CVSS 3.1 score of 9.1 reflects critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity. The vendor has released fixed versions for all affected packages, though no explicit remediation level is provided in the advisory data.

Successful exploitation allows attackers to bypass middleware gating mechanisms, potentially granting unauthorized access to protected routes or handlers within applications using the affected Clerk JavaScript libraries. This can lead to full compromise of confidentiality and integrity of the affected application components. There is no reported impact on availability. No known exploits are currently observed in the wild.

Upgrading to the fixed versions of the affected Clerk packages is the recommended remediation: @clerk/astro versions 1.5.7, 2.17.10, or 3.0.15; @clerk/nextjs versions 5.7.6, 6.39.2, or 7.2.1; @clerk/nuxt versions 1.13.28 or 2.2.2; and @clerk/shared versions 2.22.1, 3.47.4, or 4.8.1. Since the vendor advisory does not specify a remediation level beyond these fixed versions, patch status should be confirmed by consulting the vendor's official release notes or advisories. No additional mitigations are indicated.