The vulnerability in @koa/router versions 14.0.0 and before 15.0.0 arises from middleware being silently omitted from the execution chain when the router prefix includes path parameters. This behavior can lead to an access control bypass, allowing attackers to circumvent security controls implemented via middleware, such as authentication, authorization, rate limiting, or input sanitization. The CVSS 4.0 base score is 6.9, indicating a medium severity. No official fix or patch has been published yet, and the package is not a cloud service, so remediation depends on updating the package once a fix is released.

An attacker could exploit this vulnerability to bypass critical middleware protections, potentially allowing unauthorized access, evading rate limits, or bypassing input validation. The exact impact depends on what security controls the skipped middleware was enforcing. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should carefully review their use of router prefixes with path parameters and the middleware chain to identify potential bypasses. Consider implementing additional safeguards outside of the affected middleware or avoid using vulnerable versions of @koa/router if possible.