The vulnerability resides in Clerk JavaScript SDKs for Astro, Next.js, Nuxt, and shared libraries. A crafted request can bypass the createRouteMatcher function that is intended to enforce middleware gating, allowing the attacker to access protected downstream routes normally. The weakness, classified as CWE-436 and CWE-863, can result in unauthorized access to confidential data or functionality.

Affected are Clerk packages: @clerk/astro (used in Astro framework), @clerk/nextjs (used in Next.js), @clerk/nuxt (used in Nuxt), and @clerk/shared. The specific vulnerable versions are earlier than 3.0.15 for Astro, 7.2.1 for Next.js, 2.2.2 for Nuxt, and 4.8.1 for shared.

The CVSS score of 9.1 indicates a critical severity. The EPSS score, although below 1%, reflects a very low exploitation probability at the moment, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through crafted HTTP requests to bypass protection; prerequisites appear to be only legitimate access to the application’s routing layer. Given the high CVSS and the nature of the breach, the potential impact ranges from data exposure to full unauthorized control over protected resources if exploited.