CVE-2026-56681
1 advisory.
npm/9router CVE-2026-56681: high 7.3, EPSS 0.97%
9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
Action: Upgrade 9router to 0.5.8 or later.
npm i 9router@0.5.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.8 | - |
Fixed versions
| 0.5.8 |
Sources
- osv: GHSA-5mj8-gf6m-fhw8
- https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8
- https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3
- https://github.com/decolua/9router
- https://github.com/decolua/9router/releases/tag/v0.5.6
CVE-2026-56681 · published · modified · JSON