criticalPublished April 15, 2026

Clerk: routes protected with createRouteMatcher can be reached without signing in

Identifiers: CVE-2026-41248 · GHSA-vqx2-fgx2-5wq9 · CVSS 3.1 9.1 (scored by GitHub)

What it is

Clerk is the login service in many AI-built Next.js, Nuxt and Astro apps. Crafted requests slip past the createRouteMatcher check in clerkMiddleware, so pages and APIs 'protected' only with isProtectedRoute(req) → auth.protect() are reachable without an account. Apps that list public routes instead, or call auth() inside each handler, are not affected.

Who is affected

Versions inside these ranges are affected. The fixed versions are the ones to move to.

Registry	Package	Affected	Move to
npm	@clerk/nextjs	>= 5.0.0, < 5.7.6 >= 6.0.0-snapshot.vb87a27f, < 6.39.2 >= 7.0.0, < 7.2.1	5.7.6, 6.39.2, 7.2.1
npm	@clerk/nuxt	>= 1.1.0, < 1.13.28 >= 2.0.0, < 2.2.2	1.13.28, 2.2.2
npm	@clerk/astro	>= 0.0.1, < 1.5.7 >= 2.0.0-snapshot.v20241206174604, <= 2.17.9 >= 3.0.0, < 3.0.15	1.5.7, 2.17.10, 3.0.15

How to check

Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:

Linux (x86_64 or arm64), WSL and CI runners

d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps

macOS or Windows, with Docker

docker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'

Already have the CLI?

xsec deps

Or look up @clerk/nextjs, @clerk/nuxt, @clerk/astro in your lockfile and compare the version with the ranges above.

How to fix it

Upgrade the Clerk SDK you use: @clerk/nextjs to 5.7.6, 6.39.2 or 7.2.1; @clerk/nuxt to 1.13.28 or 2.2.2; @clerk/astro to 1.5.7, 2.17.10 or 3.0.15 (drop-in patches). If you import createPathMatcher from @clerk/shared yourself, update it too (2.22.1, 3.47.4 or 4.8.1). Also call auth() in handlers, server components and server actions.

Sources

This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.