tocsin

npm/@clerk/astro CVE-2026-41248: critical 9.1, EPSS 0.53%

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Action: Upgrade @clerk/astro to 1.5.7 or later.

npm i @clerk/astro@1.5.7
npm i @clerk/astro@2.17.10
npm i @clerk/astro@3.0.15

Affected

introducedfixedlast affected
0.0.11.5.7-
2.0.0-snapshot.v202412061746042.17.10-
3.0.03.0.15-

Fixed versions

1.5.72.17.103.0.15

Sources

CVE-2026-41248 · published · modified · JSON