{"cve":"CVE-2026-9495","nvd":{"published":"2026-05-26T07:16:19.243","modified":"2026-07-23T11:10:00.120","status":"Awaiting Analysis","description":"Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an attacker could bypass authentication and authorization, evade rate limiting or bypass input sanitization.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","score":5.5},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","score":7.3},"cwes":["CWE-284"],"references":["https://github.com/koajs/router/commit/d53e17f284557b1f417946f9807ee52290c3c759","https://github.com/koajs/router/issues/202","https://github.com/koajs/router/pull/206","https://security.snyk.io/vuln/SNYK-JS-KOAROUTER-12215044","https://github.com/koajs/router/pull/206"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:36:28.938604137+00:00"},"epss":{"cve":"CVE-2026-9495","score":0.0036,"percentile":0.29803,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-47p6-69vm-vw6v","url":"https://osv.dev/vulnerability/GHSA-47p6-69vm-vw6v","summary":"@koa/router has an Access Control Bypass","modified":"2026-09-10T03:51:04.483390906Z","packages":[{"ecosystem":"npm","name":"@koa/router","purl":"pkg:npm/%40koa/router","ranges":[">=14.0.0 <15.0.0"],"fixed":["15.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}