CVE-2026-9495 affects @koa/router versions 14.0.0 through before 15.0.0. The vulnerability arises when the router prefix contains path parameters, causing middleware to be silently skipped in the execution chain. This leads to an access control bypass (CWE-284), potentially allowing attackers to circumvent security controls such as authentication, authorization, rate limiting, or input sanitization. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No official patch or remediation is currently documented.

The vulnerability allows attackers to bypass critical security middleware protections silently, which can lead to unauthorized access or evasion of security controls like authentication, authorization, rate limiting, or input validation. This undermines the security posture of applications using affected versions of @koa/router and can facilitate further exploitation depending on the skipped middleware's role.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using router prefixes with path parameters or implement additional manual checks to ensure middleware execution. Monitor vendor channels for updates and apply patches promptly once released.