PT-2026-43190 · Npm · @Koa/Router

Ryan Mitchell · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-9495

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions @koa/router versions 14.0.0 through 14.x

Description An Access Control Bypass exists when a router prefix contains path parameters, causing middleware to be silently dropped from the execution chain. This allows an attacker to bypass authentication, authorization, rate limiting, or input sanitization, depending on the purpose of the skipped middleware.

Recommendations Update to version 15.0.0.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-9495

Affected Products

@Koa/Router

References · 7

• 🔥 https://github.com/koajs/router/pull/206 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9495 · Security Note
• https://github.com/koajs/router/issues/202 · Note
• https://github.com/koajs/router/commit/d53e17f284557b1f417946f9807ee52290c3c759 · Note
• https://security.snyk.io/vuln/SNYK-JS-KOAROUTER-12215044 · Note
• https://t.me/CVEtracker/54955 · Telegram Post
• https://twitter.com/UpwindMDR/status/2059326159976816760 · Twitter Post