CVE-2026-9495
Koa Router Access Control Bypass Vulnerability
Description
Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an attacker could bypass authentication and authorization, evade rate limiting or bypass input sanitization.
INFO
Published Date :
May 26, 2026, 5 a.m.
Last Modified :
May 26, 2026, 5 a.m.
Remotely Exploit :
No
Source :
snyk
Affected Products
The following products are affected by CVE-2026-9495
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the @koa/router package to version 15.0.0 or later.
- Test the application for access control bypass vulnerabilities.
- Review middleware execution logic for path parameter handling.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-9495 vulnerability anywhere in the article.