tocsin

CVE-2026-41248

4 advisories.

npm/@clerk/nextjs CVE-2026-41248: critical 9.1, EPSS 0.53%

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Action: Upgrade @clerk/nextjs to 5.7.6 or later.

npm i @clerk/nextjs@5.7.6
npm i @clerk/nextjs@6.39.2
npm i @clerk/nextjs@7.2.1

Affected

introducedfixedlast affected
5.0.05.7.6-
6.0.0-snapshot.vb87a27f6.39.2-
7.0.07.2.1-

Fixed versions

5.7.66.39.27.2.1

Sources

CVE-2026-41248 · published · modified · JSON

npm/@clerk/nuxt CVE-2026-41248: critical 9.1, EPSS 0.53%

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Action: Upgrade @clerk/nuxt to 1.13.28 or later.

npm i @clerk/nuxt@1.13.28
npm i @clerk/nuxt@2.2.2

Affected

introducedfixedlast affected
1.1.01.13.28-
2.0.02.2.2-

Fixed versions

1.13.282.2.2

Sources

CVE-2026-41248 · published · modified · JSON

npm/@clerk/astro CVE-2026-41248: critical 9.1, EPSS 0.53%

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Action: Upgrade @clerk/astro to 1.5.7 or later.

npm i @clerk/astro@1.5.7
npm i @clerk/astro@2.17.10
npm i @clerk/astro@3.0.15

Affected

introducedfixedlast affected
0.0.11.5.7-
2.0.0-snapshot.v202412061746042.17.10-
3.0.03.0.15-

Fixed versions

1.5.72.17.103.0.15

Sources

CVE-2026-41248 · published · modified · JSON

npm/@clerk/shared CVE-2026-41248: critical 9.1, EPSS 0.53%

Official Clerk JavaScript SDKs: Middleware-based route protection bypass

Action: Upgrade @clerk/shared to 2.22.1 or later.

npm i @clerk/shared@2.22.1
npm i @clerk/shared@3.47.4
npm i @clerk/shared@4.8.1

Affected

introducedfixedlast affected
2.20.172.22.1-
3.0.0-canary.v202502250915303.47.4-
4.0.04.8.1-

Fixed versions

2.22.13.47.44.8.1

Sources

CVE-2026-41248 · published · modified · JSON