@koa/router EUVD-2026-31792

The vulnerability resides in @koa/router, the official routing middleware for Koa.js (Node.js). The root cause class is CWE-284 (Improper Access Control), specifically a logic defect in how parameterized route prefixes interact with middleware path registration. In lib/layer.js, the path existence check was implemented as a JavaScript falsy check (if (this.path)) rather than a strict type guard (if (typeof this.path === 'string')). Separately, lib/router.js registered path-less .use() middleware with a fallback of '([^/]*)' and pathAsRegExp: true. When a router prefix contains path parameters (e.g., /:category), the prefix is compiled to a RegExp internally; the falsy checks then evaluate the RegExp object as truthy in some branches and handle it incorrectly in others, causing the middleware to be registered under a pattern that never matches actual requests. The middleware is silently skipped with no error. The fix in PR #206 corrects both the type checks in layer.js and replaces the '([^/]*)' fallback with an empty string '' while computing pathAsRegExp based on whether the original path was a RegExp instance. CPE: cpe:2.3:a:n/a:@koa/router:*:*:*:*:*:*:*:*.