Critical 9.1 CVSS Bypass in Clerk’s Middleware Gating

A critical CVSS 9.1 vulnerability in Clerk's createRouteMatcher can let crafted requests bypass middleware gating in Next.js, Nuxt, Astro and other frameworks, potentially allowing unauthorized traffic to reach downstream handlers. Clerk confirms sessions and authentication state are not compromised, has released drop-in fixes across affected packages, and recommends adding server-side auth() checks as a defense-in-depth mitigation.