Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on wh…

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-9495 · CVE overview and exploitation status

EUVD-2026-31792

GHSA-47p6-69vm-vw6v

cve-program · CVE-2026-9495

• https://security.snyk.io/vuln/SNYK-JS-KOAROUTER-12215044
• https://github.com/koajs/router/issues/202
• https://github.com/koajs/router/pull/206
• https://github.com/koajs/router/commit/d53e17f284557b1f417946f9807ee52290c3c759

euvd · EUVD-2026-31792

• https://security.snyk.io/vuln/SNYK-JS-KOAROUTER-12215044
• https://github.com/koajs/router/issues/202
• https://github.com/koajs/router/pull/206
• https://github.com/koajs/router/commit/d53e17f284557b1f417946f9807ee52290c3c759

nvd · CVE-2026-9495

• https://github.com/koajs/router/commit/d53e17f284557b1f417946f9807ee52290c3c759
• https://github.com/koajs/router/issues/202
• https://github.com/koajs/router/pull/206
• https://security.snyk.io/vuln/SNYK-JS-KOAROUTER-12215044

osv · GHSA-47p6-69vm-vw6v

• https://nvd.nist.gov/vuln/detail/CVE-2026-9495
• https://github.com/koajs/router/issues/202
• https://github.com/koajs/router/pull/206
• https://github.com/koajs/router/commit/d53e17f284557b1f417946f9807ee52290c3c759
• https://github.com/koajs/router
• https://security.snyk.io/vuln/SNYK-JS-KOAROUTER-12215044

No related changes are available here.