Versions of @koa/router from 14.0.0 up to but not including 15.0.0 are vulnerable to an Access Control Bypass. The bug causes middleware to be silently dropped from the execution chain whenever the router prefix contains path parameters. As a result, authentication, authorization, rate limiting and input sanitization that should have been enforced by that middleware can be circumvented, allowing an attacker to gain unauthorized access to protected resources or to manipulate requests in ways that bypass normal security controls. This weakness is categorized as CWE‑284.

The vulnerability affects the Node.js routing library @koa/router, specifically all releases from 14.0.0 through 14.x‑series and any other releases older than 15.0.0. Applications that use this library and define router prefixes with path parameters are exposed.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting that no mass exploitation campaigns are known. However, the attack vector is inferred to be remote, relying on an attacker sending crafted HTTP requests to a Koa application that utilizes the vulnerable router prefix. If the application does not enforce additional authentication or rate‑limiting at a higher level, the risk of successful exploitation remains significant.