Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an attacker could bypass authentication and authorization, evade rate limiting or bypass input sanitization.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-9495 is an access control bypass vulnerability in @koa/router versions 14.0.0 through 14.x that occurs when a router prefix contains path parameters. The middleware protection chain is silently dropped from execution, allowing attackers to bypass critical security controls including authentication, authorization, rate limiting, and input sanitization. This affects any application using vulnerable versions of @koa/router where security middleware is configured with parameterized prefixes, making it a high-severity issue (CVSS 7.3) with broad impact across Node.js web applications that rely on this popular routing library.
While this CVE maps to CWE-284 (Improper Access Control), Casky's platform would detect the attack patterns through behavioral analysis of middleware execution chains and route handling anomalies. A practitioner using Casky would observe findings related to unexpected middleware bypass patterns, unauthenticated requests reaching protected endpoints, and inconsistent security control enforcement across router instances. Claude's extended reasoning capability would correlate these signals to identify the root cause: path parameter injection in router prefix configurations that trigger silent middleware elimination. Although this CVE doesn't currently map to MITRE ATT&CK techniques, practitioners should monitor for T1190 (Exploit Public-Facing Application) and T1134 (Access Token Manipulation) patterns in their security logs, as attackers would leverage the authentication bypass to gain unauthorized access.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-9495. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation