Threats affecting pkg:npm/@koa/router

Versions of the @koa/router package from 14.0.0 up to but not including 15.0.0 contain an access control bypass vulnerability. This occurs because middleware is silently dropped from the execution chain when the router prefix includes path parameters. This flaw can allow attackers to bypass authentication, authorization, rate limiting, or input sanitization protections depending on the skipped middleware.