CVE-2026-41248

The `createRouteMatcher` function in `@clerk/nextjs`, `@clerk/nuxt`, and `@clerk/astro` can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. Sessions are not compromised, and no existing user can be impersonated; the bypass only affects the middleware-level gating decision. Apps relying solely on middleware gating via `createRouteMatcher` are affected, as a crafted request can skip middleware checks and reach downstream handlers (API routes, server components, etc.). This vulnerability arises due to an incorrect authorization check in the route matching logic, allowing unauthorized access to protected routes. The impact is significant as it can lead to unauthorized access to sensitive data or functionality if downstream handlers do not implement their own authentication checks. Mitigation involves upgrading to the patched versions of the affected packages or adding server-side auth checks inside route handlers, server compo...