What is the CVSS score of EUVD-2026-25632?

EUVD-2026-25632 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Astro are affected by EUVD-2026-25632?

Clerk's popular JavaScript authentication SDKs (@clerk/nextjs, @clerk/nuxt, @clerk/astro) have a critical security vulnerability that permits unauthorized access to protected application routes.. A patch is available.

How to fix or mitigate EUVD-2026-25632?

Within 24 hours, inventory all applications using Clerk's JavaScript SDKs and categorize which routes depend solely on middleware-based authentication without additional handler-level validation. Within 7 days, apply Clerk's released security patch to @clerk/nextjs, @clerk/nuxt, @clerk/astro, and @clerk/shared per the vendor advisory, then redeploy all affected applications. Within 30 days, perform a comprehensive audit to ensure all protected endpoints implement defense-in-depth controls with authentication checks at multiple layers.

Astro EUVD-2026-25632

| CVE-2026-41248 CRITICAL

Interpretation Conflict (CWE-436)

2026-04-24 GitHub_M

GHSA-vqx2-fgx2-5wq9

Authentication Bypass Astro Next.js Nuxt Shared

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 02:18 vuln.today

Analysis Generated

Jul 24, 2026 - 02:18 vuln.today

Patch released

Apr 29, 2026 - 20:56 nvd

Patch available

Apr 24, 2026 - 23:02 EUVD

EUVD ID Assigned

Apr 24, 2026 - 21:15 euvd

EUVD-2026-25632

CVE Published

Apr 24, 2026 - 21:04 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1

AnalysisAI

Authentication/authorization bypass in Clerk's official JavaScript SDKs (@clerk/nextjs, @clerk/nuxt, @clerk/astro, and the underlying @clerk/shared) allows unauthenticated remote attackers to defeat middleware-based route protection: a crafted request evades createRouteMatcher so that clerkMiddleware never invokes auth.protect(), letting the request reach protected downstream handlers such as API routes and server components. Sessions are not compromised and no user is impersonated — only the middleware gating decision is bypassed — so real impact is confined to apps that rely solely on middleware gating without redundant checks in their handlers. CVSS is 9.1 and SSVC rates technical impact as total, but there is no public exploit identified at time of analysis and EPSS is low at 0.09% (26th percentile).