{"action":"Upgrade @koa/router to 15.0.0 or later.","affected":[{"fixed":"15.0.0","introduced":"14.0.0"}],"component":"@koa/router","cve_ids":["CVE-2026-9495"],"ecosystem":"npm","epss":0.00611,"exploited":false,"fixed_versions":["15.0.0"],"ghsa_id":"GHSA-47p6-69vm-vw6v","id":"tcs_01M5KEZP44FCH5X71444KBNQFF","modified_at":"2026-09-10T03:51:04.483390906Z","published_at":"2026-05-26T13:30:54Z","references":["https://osv.dev/vulnerability/GHSA-47p6-69vm-vw6v","https://nvd.nist.gov/vuln/detail/CVE-2026-9495","https://github.com/koajs/router/issues/202","https://github.com/koajs/router/pull/206","https://github.com/koajs/router/commit/d53e17f284557b1f417946f9807ee52290c3c759","https://github.com/koajs/router","https://security.snyk.io/vuln/SNYK-JS-KOAROUTER-12215044"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-47p6-69vm-vw6v","url":"https://osv.dev/vulnerability/GHSA-47p6-69vm-vw6v"}],"summary":"@koa/router has an Access Control Bypass"}