# What changed in @koa/router

> 19 changes in @koa/router 10 to 15 from its official release notes, upgrade guides and advisories: 2 breaking, 1 security, 4 new APIs and options. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/npm/@koa/router/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @koa/router 15

### Security

- @koa/router has an Access Control Bypass (15.0.0) — [security advisory](https://github.com/advisories/GHSA-47P6-69VM-VW6V)

### New APIs and options

- Adds ctx.routeMatched for not-found handling. (15.4.0) — [release notes](https://github.com/koajs/router/releases/tag/v15.4.0)
- Adds a router event system for developers to use. (15.4.0) — [release notes](https://github.com/koajs/router/releases/tag/v15.4.0)
- Adds a utility to validate route params and/or migrate from previous versions to v14+. (15.2.0) — [release notes](https://github.com/koajs/router/releases/tag/v15.2.0)

### Fixes and other changes

- Hides the internal rest parameter from prefixed middleware. (15.6.0) — [release notes](https://github.com/koajs/router/releases/tag/v15.6.0)
- Prefix stripping now checks segment boundaries to prevent path corruption. (15.5.0) — [release notes](https://github.com/koajs/router/releases/tag/v15.5.0)
- Types are now compatible with Koa Middleware. (15.1.1) — [release notes](https://github.com/koajs/router/releases/tag/v15.1.1)
- The end-user types are more fully type-safe, with `any` types fixed. (15.1.0) — [release notes](https://github.com/koajs/router/releases/tag/v15.1.0)
- The router constructor exports are fixed for CommonJS. (15.1.0) — [release notes](https://github.com/koajs/router/releases/tag/v15.1.0)
- Middleware registered with `.use()` and no path params is now a global match. (15.1.0) — [release notes](https://github.com/koajs/router/releases/tag/v15.1.0)

## @koa/router 14

### Breaking changes

- The release notes state support for Node.js v20+. (13.0.0, 14.0.0) — [release notes](https://github.com/koajs/router/releases/tag/v13.0.0), [release notes](https://github.com/koajs/router/releases/tag/v14.0.0)

### Behavior and default changes

- The router supports Koa v3. (14.0.0) — [release notes](https://github.com/koajs/router/releases/tag/v14.0.0)

### Fixes and other changes

- When strict is true, the trailing option is passed to pathToRegexp. (14.0.0) — [release notes](https://github.com/koajs/router/releases/tag/v14.0.0)

## @koa/router 13

### Fixes and other changes

- Fixes an undefined property in an unmatched host. (13.0.0) — [release notes](https://github.com/koajs/router/releases/tag/v13.0.0)

## @koa/router 12

### Breaking changes

- Router.url URL-encodes path parameters. (12.0.0) — [release notes](https://github.com/koajs/router/releases/tag/v12.0.0)

## @koa/router 11

### New APIs and options

- An `exclusive` option was added. (11.0.0) — [release notes](https://github.com/koajs/router/releases/tag/v11.0.0)

### Behavior and default changes

- Route names can now be symbols. (11.0.0) — [release notes](https://github.com/koajs/router/releases/tag/v11.0.0)

### Fixes and other changes

- Path checking before route registration was improved. (11.0.0) — [release notes](https://github.com/koajs/router/releases/tag/v11.0.0)

## @koa/router 10

### Behavior and default changes

- router.redirect() now accepts external destinations. (10.0.0) — [release notes](https://github.com/koajs/router/releases/tag/v10.0.0)