Koa Router
Monthly
Access control bypass in @koa/router versions 14.0.0 to before 15.0.0 allows attackers to skip middleware execution when the router prefix contains path parameters. This can lead to authentication and authorization bypass, rate limit evasion, or input sanitization circumvention. A public proof-of-concept is available, but no active exploitation has been reported (EPSS 0.09%).
Access control bypass in @koa/router versions 14.0.0 to before 15.0.0 allows attackers to skip middleware execution when the router prefix contains path parameters. This can lead to authentication and authorization bypass, rate limit evasion, or input sanitization circumvention. A public proof-of-concept is available, but no active exploitation has been reported (EPSS 0.09%).