# 9router (npm) vulnerabilities 19 known vulnerabilities (6 critical, 10 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.5.112 (Oct 28, 2026): no advisory affects it - Newest unaffected release: 0.5.112 (Oct 28, 2026), the latest release - Weekly downloads: 95.2K - Dependents: 2 - Releases: 231 since 0.2.13 (Jan 3, 2026) - Registry: https://www.npmjs.com/package/9router - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-56682: 0.2.13 to 0.5.4 (0.5.8 is outside it) - CVE-2026-56681: 0.2.13 to 0.5.4 (0.5.8 is outside it) - CVE-2026-56677: 0.2.13 to 0.5.4 (0.5.8 is outside it) - CVE-2026-56678: 0.2.13 to 0.5.4 (0.5.8 is outside it) - CVE-2026-56679: 0.2.13 to 0.5.3 (0.5.4 is outside it) - CVE-2026-49353: 0.2.13 to 0.4.55 (0.4.58 is outside it) - CVE-2026-49352: 0.2.21 to 0.4.41 (0.4.45 is outside it) - CVE-2026-46339: 0.4.31 to 0.4.36 (0.4.37 is outside it) - CVE-2026-62328: 0.2.13 to 0.4.41 (0.4.45 is outside it) - CVE-2026-62327: 0.2.13 to 0.4.41 (0.4.45 is outside it) - CVE-2026-59801: 0.2.13 to 0.4.41 (0.4.45 is outside it) - CVE-2026-56675: 0.2.13 to 0.4.80 (0.5.2 is outside it) - CVE-2026-55638: 0.2.13 to 0.4.80 (0.5.2 is outside it) - CVE-2026-55641: 0.2.13 to 0.4.80 (0.5.2 is outside it) - CVE-2026-56676: 0.2.13 to 0.4.80 (0.5.2 is outside it) - CVE-2026-55500: 0.2.13 to 0.4.71 (0.4.80 is outside it) - CVE-2026-55501: 0.2.13 to 0.4.71 (0.4.80 is outside it) - CVE-2026-59800: 0.2.13 to 0.4.41 (0.4.45 is outside it) - CVE-2026-5842: 0.2.13 to 0.3.74 (0.3.75 is outside it) ## Advisories (19) ### [CVE-2026-56682](https://cve.now/CVE-2026-56682): 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header - Severity: Medium 5.3 - Published: Sep 22, 2026 - Affected: fixed in 0.5.8. - Fixed in 0.5.8 (released Jun 21, 2026, 93 days before disclosure). - The latest release, 0.5.112, is not affected. - 4.2% of 9router downloads last week were affected versions (1.9K). ### [CVE-2026-56681](https://cve.now/CVE-2026-56681): 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header - Severity: High 7.3 - Published: Sep 22, 2026 - Affected: fixed in 0.5.8. - Fixed in 0.5.8 (released Jun 21, 2026, 93 days before disclosure). - The latest release, 0.5.112, is not affected. - 4.2% of 9router downloads last week were affected versions (1.9K). ### [CVE-2026-56677](https://cve.now/CVE-2026-56677): 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint - Severity: High 8.6 - Published: Aug 17, 2026 - Affected: through 0.5.4. - Fixed in 0.5.8 (released Jun 21, 2026, 57 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.5.112, is not affected. - 4.2% of 9router downloads last week were affected versions (1.9K). ### [CVE-2026-56678](https://cve.now/CVE-2026-56678): 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding - Severity: Medium 6.4 - Published: Jul 15, 2026 - Affected: fixed in 0.5.6. - Fixed in 0.5.8 (released Jun 21, 2026, 24 days before disclosure, the advisory names 0.5.6, which was never published). - The latest release, 0.5.112, is not affected. - 4.2% of 9router downloads last week were affected versions (1.9K). ### [CVE-2026-56679](https://cve.now/CVE-2026-56679): 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade - Severity: High 8.7 - Published: Jul 15, 2026 - Affected: fixed in 0.5.4. - Fixed in 0.5.4 (released Jun 18, 2026, 27 days before disclosure). - The latest release, 0.5.112, is not affected. - 4% of 9router downloads last week were affected versions (1.8K). ### [CVE-2026-49353](https://cve.now/CVE-2026-49353): 9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING - Severity: High 7.5 - Published: Jul 15, 2026 - Affected: through 0.4.55. - Fixed in 0.4.58 (released May 21, 2026, 55 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.5.112, is not affected. - 3.4% of 9router downloads last week were affected versions (1.5K). ### [CVE-2026-49352](https://cve.now/CVE-2026-49352): 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass - Severity: Critical 9.8 - Published: Jul 15, 2026 - Affected: from 0.2.21, fixed in 0.4.45. - Fixed in 0.4.45 (released May 15, 2026, 61 days before disclosure). - The latest release, 0.5.112, is not affected. - 3% of 9router downloads last week were affected versions (1.4K). ### [CVE-2026-46339](https://cve.now/CVE-2026-46339): 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes - Severity: Critical 10.0 - Published: Jul 15, 2026 - Affected: from 0.4.30, fixed in 0.4.37. - Fixed in 0.4.37 (released May 13, 2026, 63 days before disclosure). - The latest release, 0.5.112, is not affected. - 0.2% of 9router downloads last week were affected versions (86). ### [CVE-2026-62328](https://cve.now/CVE-2026-62328): 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints - Severity: High 8.7 - Published: Jul 13, 2026 - Affected: through 0.4.41. - Fixed in 0.4.45 (released May 15, 2026, 59 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.5.112, is not affected. - 3.2% of 9router downloads last week were affected versions (1.4K). ### [CVE-2026-62327](https://cve.now/CVE-2026-62327): 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats - Severity: Critical 9.3 - Published: Jul 13, 2026 - Affected: through 0.4.41. - Fixed in 0.4.45 (released May 15, 2026, 59 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.5.112, is not affected. - 3.2% of 9router downloads last week were affected versions (1.4K). ### [CVE-2026-59801](https://cve.now/CVE-2026-59801): 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers - Severity: Critical 9.3 - Published: Jul 13, 2026 - Affected: through 0.4.41. - Fixed in 0.4.45 (released May 15, 2026, 59 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.5.112, is not affected. - 3.2% of 9router downloads last week were affected versions (1.4K). ### [CVE-2026-56675](https://cve.now/CVE-2026-56675): 9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs - Severity: High 8.3 - Published: Jul 10, 2026 - Affected: fixed in 0.5.2. - Fixed in 0.5.2 (released Jun 17, 2026, 23 days before disclosure). - The latest release, 0.5.112, is not affected. - 3.8% of 9router downloads last week were affected versions (1.7K). ### [CVE-2026-55638](https://cve.now/CVE-2026-55638): 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass - Severity: High 8.6 - Published: Jul 10, 2026 - Affected: fixed in 0.5.2. - Fixed in 0.5.2 (released Jun 17, 2026, 23 days before disclosure). - The latest release, 0.5.112, is not affected. - 3.8% of 9router downloads last week were affected versions (1.7K). ### [CVE-2026-55641](https://cve.now/CVE-2026-55641): 9router: Unauthenticated \`/v1\` proxy access via \`Host\`-header spoofing → open AI relay + SSRF - Severity: High 8.2 - Published: Jul 10, 2026 - Affected: fixed in 0.5.2. - Fixed in 0.5.2 (released Jun 17, 2026, 23 days before disclosure). - The latest release, 0.5.112, is not affected. - 3.8% of 9router downloads last week were affected versions (1.7K). ### [CVE-2026-56676](https://cve.now/CVE-2026-56676): 9router: Image prefetch DNS rebinding allows SSRF to internal services - Severity: High 7.4 - Published: Jul 10, 2026 - Affected: fixed in 0.5.2. - Fixed in 0.5.2 (released Jun 17, 2026, 23 days before disclosure). - The latest release, 0.5.112, is not affected. - 3.8% of 9router downloads last week were affected versions (1.7K). ### [CVE-2026-55500](https://cve.now/CVE-2026-55500): 9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover - Severity: Critical 9.9 - Published: Jul 10, 2026 - Affected: through 0.4.71. - Fixed in 0.4.80 (released Jun 13, 2026, 27 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 0.5.112, is not affected. - 3.7% of 9router downloads last week were affected versions (1.7K). ### [CVE-2026-55501](https://cve.now/CVE-2026-55501): 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header - Severity: High 7.3 - Published: Jul 10, 2026 - Affected: fixed in 0.4.77. - Fixed in 0.4.80 (released Jun 13, 2026, 27 days before disclosure, the advisory names 0.4.77, which was never published). - The latest release, 0.5.112, is not affected. - 3.7% of 9router downloads last week were affected versions (1.7K). ### [CVE-2026-59800](https://cve.now/CVE-2026-59800): 9Router \< 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint - Severity: Critical 9.2 - Published: Jul 7, 2026 - Affected: fixed in 0.4.44. - Fixed in 0.4.45 (released May 15, 2026, 53 days before disclosure, the advisory names 0.4.44, which was never published). - The latest release, 0.5.112, is not affected. - 3.2% of 9router downloads last week were affected versions (1.4K). ### [CVE-2026-5842](https://cve.now/CVE-2026-5842): decolua 9router Administrative API Endpoint api authorization - Severity: Medium 6.9 - Published: Apr 9, 2026 - Affected: fixed in 0.3.75. - Fixed in 0.3.75 (released Apr 4, 2026, 5 days before disclosure). - The latest release, 0.5.112, is not affected. - 1.7% of 9router downloads last week were affected versions (752). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/9router Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.