CVE-2026-9495

Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an attacker could bypass authentication and authorization, evade rate limiting or bypass input sanitization.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/koajs/router/commit/d53e17f284557b1f417946f9807ee52290c3c759
https://github.com/koajs/router/issues/202
https://github.com/koajs/router/pull/206
https://security.snyk.io/vuln/SNYK-JS-KOAROUTER-12215044
https://github.com/koajs/router/pull/206

Configurations

No configuration.

History

23 Jul 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Las versiones del paquete @koa/router desde la 14.0.0 y anteriores a la 15.0.0 son vulnerables a una omisión de control de acceso debido a que el middleware se elimina silenciosamente de la cadena de ejecución cuando el prefijo del router contiene parámetros de ruta. Dependiendo de lo que el middleware omitido debía proteger, un atacante podría omitir la autenticación y la autorización, evadir la limitación de velocidad o omitir la sanitización de entrada.

26 May 2026, 14:16

Type	Values Removed	Values Added
References	~~() https://github.com/koajs/router/pull/206 -~~	() https://github.com/koajs/router/pull/206 -

26 May 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-26 07:16

Updated : 2026-07-23 11:10

NVD link : CVE-2026-9495

Mitre link : CVE-2026-9495

CVE.ORG link : CVE-2026-9495

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-9495", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9495", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T12:41:11.506721Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "report@snyk.io", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "report@snyk.io", "affectedData": [{"vendor": "n/a", "product": "@koa/router", "versions": [{"status": "affected", "version": "14.0.0", "lessThan": "15.0.0", "versionType": "semver"}]}]}], "published": "2026-05-26T07:16:19.243", "references": [{"url": "https://github.com/koajs/router/commit/d53e17f284557b1f417946f9807ee52290c3c759", "source": "report@snyk.io"}, {"url": "https://github.com/koajs/router/issues/202", "source": "report@snyk.io"}, {"url": "https://github.com/koajs/router/pull/206", "source": "report@snyk.io"}, {"url": "https://security.snyk.io/vuln/SNYK-JS-KOAROUTER-12215044", "source": "report@snyk.io"}, {"url": "https://github.com/koajs/router/pull/206", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "report@snyk.io", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an attacker could bypass authentication and authorization, evade rate limiting or bypass input sanitization."}, {"lang": "es", "value": "Las versiones del paquete @koa/router desde la 14.0.0 y anteriores a la 15.0.0 son vulnerables a una omisi\u00f3n de control de acceso debido a que el middleware se elimina silenciosamente de la cadena de ejecuci\u00f3n cuando el prefijo del router contiene par\u00e1metros de ruta. Dependiendo de lo que el middleware omitido deb\u00eda proteger, un atacante podr\u00eda omitir la autenticaci\u00f3n y la autorizaci\u00f3n, evadir la limitaci\u00f3n de velocidad o omitir la sanitizaci\u00f3n de entrada."}], "lastModified": "2026-07-23T11:10:00.120", "sourceIdentifier": "report@snyk.io"}