CVE-2026-9495 Overview
CVE-2026-9495 affects the @koa/router package versions 14.0.0 through 15.0.0 (exclusive). The vulnerability allows access control bypass because middleware is silently dropped from the execution chain when the router prefix contains path parameters. Attackers can exploit this flaw to bypass authentication and authorization, evade rate limiting, or skip input sanitization layers. The issue falls under [CWE-284] Improper Access Control and impacts Node.js applications using Koa's routing layer.
Critical Impact
Skipped middleware in routes with parameterized prefixes can disable authentication, rate limiting, and input sanitization, exposing protected endpoints to unauthenticated network attackers.
Affected Products
- @koa/router version 14.0.0
- @koa/router versions after 14.0.0 and before 15.0.0
- Node.js applications using Koa routing with parameterized route prefixes
Discovery Timeline
- 2026-05-26 - CVE-2026-9495 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-9495
Vulnerability Analysis
The @koa/router package provides routing middleware for Koa web applications. Developers chain middleware functions to routes to enforce authentication, rate limiting, and input validation. The router supports a prefix option that prepends a path segment to all routes registered against the router instance.
When the prefix contains path parameters such as /:tenant or /users/:id, the router fails to correctly attach middleware registered through router.use() to the execution chain. The middleware is silently dropped at registration or dispatch time without producing a runtime error or warning. Requests reach the route handler directly, bypassing any protective logic defined in the middleware stack.
This falls under business logic and access control failures because the missing enforcement is invisible to developers performing standard functional testing. Routes appear to work correctly because handlers still execute and return expected responses.
Root Cause
The defect lives in the prefix parsing logic of the router. When path parameters are present in the prefix, the internal middleware composition routine does not include router.use() middleware in the dispatched stack. See the GitHub Issue Discussion and the GitHub Pull Request for the maintainer analysis.
Attack Vector
An attacker sends a network request to an endpoint mounted under a router whose prefix contains a path parameter. Because the protective middleware never executes, the request reaches the handler without authentication checks, rate limiting, or input sanitization. No authentication or user interaction is required to trigger the bypass. Refer to the Snyk Vulnerability Report for additional exploitation context.
The vulnerability manifests in middleware registration logic for parameterized prefixes. See the linked advisory and patch commit for technical details, since no public proof-of-concept code has been released.
Detection Methods for CVE-2026-9495
Indicators of Compromise
- Successful requests to protected endpoints originating from unauthenticated sources or sessions lacking expected authorization tokens.
- Anomalous request volumes against endpoints that should be rate-limited, with no corresponding throttling responses.
- Unsanitized payloads reaching backend logs or downstream systems when input validation middleware is expected upstream.
Detection Strategies
- Inventory Node.js applications and audit package.json and package-lock.json for @koa/router versions between 14.0.0 and 15.0.0.
- Review router definitions for prefix values containing colon parameters such as /:tenant or /api/:version, then verify middleware execution with integration tests.
- Instrument middleware functions with logging to confirm they execute for every request path served under parameterized prefixes.
Monitoring Recommendations
- Log authentication outcomes at the handler layer to identify requests that reached business logic without a prior authentication event.
- Correlate web access logs with authentication and rate limit telemetry to detect coverage gaps on parameterized routes.
- Alert on HTTP 2xx responses to sensitive endpoints when no corresponding authentication or authorization log entry exists.
How to Mitigate CVE-2026-9495
Immediate Actions Required
- Upgrade @koa/router to version 15.0.0 or later across all affected services.
- Audit all router.prefix() and new Router({ prefix: ... }) declarations for parameterized segments and validate middleware execution.
- Add integration tests asserting that authentication, authorization, and rate limit middleware execute for every route under parameterized prefixes.
Patch Information
The fix is available in the upstream commit referenced in the GitHub Commit Update and merged via the GitHub Pull Request. Upgrade to @koa/router15.0.0 or later to resolve the issue.
Workarounds
- Refactor affected routers to remove path parameters from the prefix and move parameterized segments into individual route definitions.
- Attach protective middleware directly to each route definition instead of relying on router.use() at the router level.
- Enforce authentication, authorization, and rate limiting at an upstream reverse proxy or API gateway until the package is upgraded.
# Upgrade @koa/router to a fixed version
npm install @koa/router@^15.0.0
# Verify the installed version
npm ls @koa/router
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
