Skip to main content
cve.nowby Sazabi
← npm
npmPackage

9router

19 known vulnerabilities (6 critical, 10 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
0.5.112 (Oct 28, 2026): no advisory affects it
Newest unaffected release
0.5.112 (Oct 28, 2026), the latest release
Advisories
19 · 6 critical, 10 high, 3 medium
Weekly downloads
95.2K
Dependents
2
Releases
231 since 0.2.13 (Jan 3, 2026)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 19 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 19

  • CVE-2026-56682Medium 5.3

    9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

    Affected: fixed in 0.5.8.

    Fixed in 0.5.8 (released Jun 21, 2026, 93 days before disclosure).

    The latest release, 0.5.112, is not affected.

    4.2% of 9router downloads last week were affected versions (1.9K).

  • 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

    Affected: fixed in 0.5.8.

    Fixed in 0.5.8 (released Jun 21, 2026, 93 days before disclosure).

    The latest release, 0.5.112, is not affected.

    4.2% of 9router downloads last week were affected versions (1.9K).

  • 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

    Affected: through 0.5.4.

    Fixed in 0.5.8 (released Jun 21, 2026, 57 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.5.112, is not affected.

    4.2% of 9router downloads last week were affected versions (1.9K).

  • CVE-2026-56678Medium 6.4

    9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

    Affected: fixed in 0.5.6.

    Fixed in 0.5.8 (released Jun 21, 2026, 24 days before disclosure, the advisory names 0.5.6, which was never published).

    The latest release, 0.5.112, is not affected.

    4.2% of 9router downloads last week were affected versions (1.9K).

  • 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

    Affected: fixed in 0.5.4.

    Fixed in 0.5.4 (released Jun 18, 2026, 27 days before disclosure).

    The latest release, 0.5.112, is not affected.

    4% of 9router downloads last week were affected versions (1.8K).

  • 9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING

    Affected: through 0.4.55.

    Fixed in 0.4.58 (released May 21, 2026, 55 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.5.112, is not affected.

    3.4% of 9router downloads last week were affected versions (1.5K).

  • CVE-2026-49352Critical 9.8

    9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

    Affected: from 0.2.21, fixed in 0.4.45.

    Fixed in 0.4.45 (released May 15, 2026, 61 days before disclosure).

    The latest release, 0.5.112, is not affected.

    3% of 9router downloads last week were affected versions (1.4K).

  • CVE-2026-46339Critical 10.0

    9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

    Affected: from 0.4.30, fixed in 0.4.37.

    Fixed in 0.4.37 (released May 13, 2026, 63 days before disclosure).

    The latest release, 0.5.112, is not affected.

    0.2% of 9router downloads last week were affected versions (86).

  • 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints

    Affected: through 0.4.41.

    Fixed in 0.4.45 (released May 15, 2026, 59 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.5.112, is not affected.

    3.2% of 9router downloads last week were affected versions (1.4K).

  • CVE-2026-62327Critical 9.3

    9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats

    Affected: through 0.4.41.

    Fixed in 0.4.45 (released May 15, 2026, 59 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.5.112, is not affected.

    3.2% of 9router downloads last week were affected versions (1.4K).

  • CVE-2026-59801Critical 9.3

    9Router 0.4.41 - Unauthenticated API Exposure via /api/providers

    Affected: through 0.4.41.

    Fixed in 0.4.45 (released May 15, 2026, 59 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.5.112, is not affected.

    3.2% of 9router downloads last week were affected versions (1.4K).

  • 9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs

    Affected: fixed in 0.5.2.

    Fixed in 0.5.2 (released Jun 17, 2026, 23 days before disclosure).

    The latest release, 0.5.112, is not affected.

    3.8% of 9router downloads last week were affected versions (1.7K).

  • 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

    Affected: fixed in 0.5.2.

    Fixed in 0.5.2 (released Jun 17, 2026, 23 days before disclosure).

    The latest release, 0.5.112, is not affected.

    3.8% of 9router downloads last week were affected versions (1.7K).

  • 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

    Affected: fixed in 0.5.2.

    Fixed in 0.5.2 (released Jun 17, 2026, 23 days before disclosure).

    The latest release, 0.5.112, is not affected.

    3.8% of 9router downloads last week were affected versions (1.7K).

  • 9router: Image prefetch DNS rebinding allows SSRF to internal services

    Affected: fixed in 0.5.2.

    Fixed in 0.5.2 (released Jun 17, 2026, 23 days before disclosure).

    The latest release, 0.5.112, is not affected.

    3.8% of 9router downloads last week were affected versions (1.7K).

Show all 19 advisoriesShow fewer advisories
  • CVE-2026-55500Critical 9.9

    9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover

    Affected: through 0.4.71.

    Fixed in 0.4.80 (released Jun 13, 2026, 27 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 0.5.112, is not affected.

    3.7% of 9router downloads last week were affected versions (1.7K).

  • 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header

    Affected: fixed in 0.4.77.

    Fixed in 0.4.80 (released Jun 13, 2026, 27 days before disclosure, the advisory names 0.4.77, which was never published).

    The latest release, 0.5.112, is not affected.

    3.7% of 9router downloads last week were affected versions (1.7K).

  • CVE-2026-59800Critical 9.2

    9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint

    Affected: fixed in 0.4.44.

    Fixed in 0.4.45 (released May 15, 2026, 53 days before disclosure, the advisory names 0.4.44, which was never published).

    The latest release, 0.5.112, is not affected.

    3.2% of 9router downloads last week were affected versions (1.4K).

  • CVE-2026-5842Medium 6.9

    decolua 9router Administrative API Endpoint api authorization

    Affected: fixed in 0.3.75.

    Fixed in 0.3.75 (released Apr 4, 2026, 5 days before disclosure).

    The latest release, 0.5.112, is not affected.

    1.7% of 9router downloads last week were affected versions (752).