npm/9router CVE-2026-56677: high 8.6, EPSS 0.38%

9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-8g4w-4ffg-8vgx
• https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx
• https://github.com/decolua/9router

CVE-2026-56677 · published 2026-08-17T21:58:43Z · modified 2026-08-17T22:11:02.180370Z · JSON