npm / @koa/router
@koa/router
What changed in @koa/router 10 to 15, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.
2 breaking1 security4 new APIs and options3 behavior and defaults9 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@koa/router 1510 changes
Security 1
@koa/router has an Access Control Bypass
New APIs and options 3
Adds ctx.routeMatched for not-found handling.
Adds a router event system for developers to use.
Adds a utility to validate route params and/or migrate from previous versions to v14+.
Fixes and other changes 6
Hides the internal rest parameter from prefixed middleware.
Prefix stripping now checks segment boundaries to prevent path corruption.
Types are now compatible with Koa Middleware.
The end-user types are more fully type-safe, with
anytypes fixed.The router constructor exports are fixed for CommonJS.
Middleware registered with
.use()and no path params is now a global match.
@koa/router 143 changes
Breaking changes 1
The release notes state support for Node.js v20+.
Behavior and default changes 1
The router supports Koa v3.
Fixes and other changes 1
When strict is true, the trailing option is passed to pathToRegexp.
@koa/router 131 changes
Fixes and other changes 1
Fixes an undefined property in an unmatched host.
@koa/router 121 changes
Breaking changes 1
Router.url URL-encodes path parameters.
@koa/router 113 changes
New APIs and options 1
An
exclusiveoption was added.
Behavior and default changes 1
Route names can now be symbols.
Fixes and other changes 1
Path checking before route registration was improved.
@koa/router 101 changes
Behavior and default changes 1
router.redirect() now accepts external destinations.