CVE-2026-41248: Clerk Create Route Matcher Affirmative Gate Bypass
Affirmative use of createRouteMatcher — `if ($MATCHER(req)) { await auth.protect(); }` — is the vulnerable shape for CVE-2026-41248. In @clerk/shared versions before 2.22.1 / 3.47.4 / 4.8.1 the matcher compared the raw pathname without URL normalization, so crafted requests (`/api/%61dmin/...`, `//api/admin/...`, `/api/foo/%2e%2e/admin/...`) skipped the matc
TSgreprules fetch cve-2026-41248-clerk-create-route-matcher-affirmative-gate-bypass --engine opengrepDescription
Affirmative use of createRouteMatcher — `if ($MATCHER(req)) { await auth.protect(); }` — is the vulnerable shape for CVE-2026-41248. In @clerk/shared versions before 2.22.1 / 3.47.4 / 4.8.1 the matcher compared the raw pathname without URL normalization, so crafted requests (`/api/%61dmin/...`, `//api/admin/...`, `/api/foo/%2e%2e/admin/...`) skipped the matc
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.