Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers. This vulnerability is fixed in @clerk/astro 1.5.7, 2.17.10, and 3.0.15; @clerk/nextjs 5.7.6, 6.39.2, and 7.2.1; @clerk/nuxt 1.13.28 and 2.2.2; and @clerk/shared 2.22.1, 3.47.4, anc 4.8.1
The vulnerability results from incorrect interpretation or ambiguous handling of requests (CWE-436 — Interpretation Conflict) combined with improper authorization verification (CWE-863 — Incorrect Authorization). A specially crafted HTTP request is recognized by the createRouteMatcher middleware in a manner deviating from the intended behavior, resulting in the bypass of gating logic. As a result, the request proceeds directly to downstream handlers, bypassing the required user identity verification.
An attacker without any authentication (PR:N, UI:N) can gain unauthorized access to protected application resources and potentially modify data, resulting in high impact on system confidentiality and integrity.
Libraries must be urgently updated to patched versions: @clerk/astro to 1.5.7, 2.17.10 or 3.0.15; @clerk/nextjs to 5.7.6, 6.39.2 or 7.2.1; @clerk/nuxt to 1.13.28 or 2.2.2; @clerk/shared to 2.22.1, 3.47.4 or 4.8.1. Details are available in vendor references on GitHub Security Advisories.
@clerk/astro in versions prior to 1.5.7, 2.17.10 and 3.0.15; @clerk/nextjs in versions prior to 5.7.6, 6.39.2 and 7.2.1; @clerk/nuxt in versions prior to 1.13.28 and 2.2.2; @clerk/shared in versions prior to 2.22.1, 3.47.4 and 4.8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N