CVE-2026-46339

npm/9router CVE-2026-46339: critical 10, EPSS 3.35%

9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

Action: Upgrade 9router to 0.4.37 or later.

npm i 9router@0.4.37

Affected

Fixed versions

Sources

• osv: GHSA-fhh6-4qxv-rpqj
• https://github.com/decolua/9router/security/advisories/GHSA-fhh6-4qxv-rpqj
• https://github.com/decolua/9router

CVE-2026-46339 · published 2026-05-19T19:22:05Z · modified 2026-05-19T19:41:27.045250Z · JSON