Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an attacker could bypass authentication and authorization, evade rate limiting or bypass input sanitization.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|
References
History
Tue, 26 May 2026 07:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Access Control Bypass in Koa Router Prefix Path Parameters |
Tue, 26 May 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an attacker could bypass authentication and authorization, evade rate limiting or bypass input sanitization. | |
| Weaknesses | CWE-284 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: snyk
Published:
Updated: 2026-05-26T05:00:04.704Z
Reserved: 2026-05-25T09:18:41.020Z
Link: CVE-2026-9495
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-26T07:30:36Z