9.1

CVE-2026-41248: @clerk astro Interpretation Conflict

CVSS: 9.1v3.1CriticalDeferred
AliasesGHSA-vqx2-fgx2-5wq9
Published 24-04-2026Last modified 27-04-2026
Open JSON

Vulnerability summary

CVE-2026-41248 is a critical (CVSS 9.1) Interpretation Conflict vulnerability in @clerk astro. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.4% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.53%
0%100%
Low · +0.21 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 24-04-2026
    PublishedVulnerability first disclosed.
  2. 27-04-2026
    Last modifiedVulnerability information updated.

Description

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.53%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

+0.21 pp

From 0.32% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.53%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

@clerk8 products
  • astro≥ 0.0.1, < 1.5.7 | ≥ 2.0.0-snapshot.v20241206174604, ≤ 2.17.9 | ≥ 3.0.0, < 3.0.15
  • nextjs≥ 5.0.0, < 5.7.6 | ≥ 6.0.0-snapshot.vb87a27f, < 6.39.2 | ≥ 7.0.0, < 7.2.1
  • nuxt≥ 1.1.0, < 1.13.28 | ≥ 2.0.0, < 2.2.2
  • shared≥ 2.20.17, < 2.22.1 | ≥ 3.0.0-canary.v20250225091530, < 3.47.4 | ≥ 4.0.0, < 4.8.1
  • astro≥ 0.0.1, < 1.5.7 | ≥ 2.0.0-snapshot.v20241206174604, < 2.17.10 | ≥ 3.0.0, < 3.0.15

1 vendor · 8 products

References

3 links