Vulnerability · Published May 26, 2026 · Assigned by snyk
CVE-2026-9495
High 7.3
In plain English
A high-severity improper access control in @koa/router. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an attacker could bypass authentication and authorization, evade rate limiting or bypass input sanitization.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @koa/router | 15.0.0 | GHSA-47p6-69vm-vw6v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | @koa/router | 14.0.0 – before 15.0.0 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P