Access Control Bypass in @koa/router Affects Koa.js Framework

CVE-2026-9495

What is CVE-2026-9495?

Versions of the @koa/router package up to 14.0.0 are prone to an Access Control Bypass vulnerability. This occurs when middleware is inadvertently excluded from the execution stack when path parameters are included in the router prefix. This oversight can allow attackers to circumvent crucial security mechanisms, potentially leading to unauthorized access, evading rate limits, or bypassing input sanitization measures that would normally protect an application.

References