5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9495

CVE-2026-9495: @koa/router has an Access Control Bypass

Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an attacker could bypass authentication and authorization, evade rate limiting or bypass input sanitization.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9495

CVE-2026-9495:

5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@koa/router	npm	>= 14.0.0, < 15.0.0	15.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an access control bypass in @koa/router where middleware is skipped if a router's prefix contains path parameters (e.g., new Router({ prefix: '/:tenant' })).

The root cause lies in how these parameterized prefixes were applied to middleware and routes. The Layer.setPrefix function would naively concatenate the prefix with the layer's path. When a middleware was added to a router with a parameterized prefix, its path would become something like /:tenant(.*). The path-to-regexp library would then generate a regular expression that the router's matching logic could not correctly use to match incoming requests, causing the middleware to be "silently dropped".

The vulnerable functions are:

Layer.setPrefix in lib/layer.js: It incorrectly concatenated prefixes with parameters.
Router.use in lib/router.js: It used Layer.setPrefix to apply the flawed prefix logic to middleware layers.
Router.routes in lib/router.js: It returned the middleware that relied on the flawed matching logic, ultimately failing to execute the necessary middleware.

The fix, part of a complete rewrite from JavaScript to TypeScript in commit d53e17f284557b1f417946f9807ee52290c3c759, addresses this by fundamentally changing how prefixes with parameters are handled. The new implementation detects if a prefix has parameters. If so, it avoids prepending the prefix to individual layers. Instead, the routes() method generates a special wrapper middleware. This wrapper's sole responsibility is to match the parameterized prefix, extract the prefix parameters, and then call the main router dispatch function. This separation of concerns ensures that both the prefix parameters are correctly parsed and the subsequent middleware and route handlers are executed as expected.

Vulnerable functions

Router.use

lib/router.js

This function adds middleware to a router. When the router is configured with a prefix containing path parameters (e.g., `/:tenant`), this method calls `setPrefix`, which incorrectly constructs a path for the middleware layer (e.g., `/:tenant(.*)`). The router's matching logic subsequently fails to match this pattern for incoming requests, causing the middleware to be skipped entirely.

Router.routes

lib/router.js

This function returns the main router middleware. The returned middleware relies on a matching mechanism (`router.match`) that cannot correctly process middleware layers whose paths have been prefixed with parameters. This results in the middleware being silently ignored during a request, leading to a potential access control bypass. The fix involves wrapping the dispatch logic in another middleware that specifically handles prefix parameter parsing.

Layer.setPrefix

lib/layer.js

This function is at the core of the vulnerability. It modifies a layer's path by simply prepending the router's prefix. It does not differentiate between static prefixes and prefixes with parameters. This leads to the creation of an invalid path pattern (e.g., `/:tenant(.*)`) for middleware when parameters are present in the prefix, which the matching engine cannot handle as intended.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.