EUVD-2026-25632
GHSA-vqx2-fgx2-5wq9
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Interpretation consistency
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Authentication/authorization bypass in Clerk's official JavaScript SDKs (@clerk/nextjs, @clerk/nuxt, @clerk/astro, and the underlying @clerk/shared) allows unauthenticated remote attackers to defeat middleware-based route protection: a crafted request evades createRouteMatcher so that clerkMiddleware never invokes auth.protect(), letting the request reach protected downstream handlers such as API routes and server components. Sessions are not compromised and no user is impersonated — only the middleware gating decision is bypassed — so real impact is confined to apps that rely solely on middleware gating without redundant checks in their handlers. CVSS is 9.1 and SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is low at 0.09% (26th percentile).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 15 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Next.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1
Executive ViewAI
Clerk's popular JavaScript authentication SDKs (@clerk/nextjs, @clerk/nuxt, @clerk/astro) have a critical security vulnerability that permits unauthorized access to protected application routes. Organizations using these libraries could face data exposure or unauthorized feature access if their implementations rely on Clerk's middleware alone for access control. Immediate update and validation of application architecture is required.
Within 24 hours, inventory all applications using Clerk's JavaScript SDKs and categorize which routes depend solely on middleware-based authentication without additional handler-level validation. Within 7 days, apply Clerk's released security patch to @clerk/nextjs, @clerk/nuxt, @clerk/astro, and @clerk/shared per the vendor advisory, then redeploy all affected applications. Within 30 days, perform a comprehensive audit to ensure all protected endpoints implement defense-in-depth controls with authentication checks at multiple layers.
Apply vendor patch. As interim mitigation during deployment, implement redundant authentication validation in application handlers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Next.js versions 1.11.4 through 15.2.2 contain a critical middleware authorization bypass via the x-middleware-subreques
ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to
Improper restriction of excessive authentication attempts (CWE-307) in the 9Router AI router package (decolua/9router) b
Authorization bypass in the Sentry Next.js SDK affects @sentry/nextjs from 9.36.0 before 9.47.2, 10.x before 10.75.2, an
A remote code execution vulnerability (CVSS 9.1). Critical severity with potential for significant impact on affected sy
Server-side request forgery in the Progress Sitefinity Next.js SDK npm package (@progress/sitefinity-nextjs-sdk, version
Prototype pollution in tRPC's @trpc/server package, specifically within the `formDataToObject` function used by the expe
A security vulnerability in Next.js applications. In Auth0 Next.js SDK (CVSS 7.7). High severity vulnerability requiring
Unauthenticated remote attackers can repeatedly invoke the revalidateProducts Server Action in the MarcosCamara01 Ecomme
Unauthenticated remote attackers can call the cleanCache handler in NotionNext's pages/api/cache.js to force cache inval
Concurrent token requests handled by the Auth0 Next.js SDK can be resolved through an internal in-flight request cache t
Next.js is a React framework for building full-stack web applications. Rated low severity (CVSS 3.7), this vulnerability
Exploit-DB