CVE-2026-56682
1 advisory.
npm/9router CVE-2026-56682: medium 5.3
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
Action: Upgrade 9router to 0.5.8 or later.
npm i 9router@0.5.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.8 | - |
Fixed versions
| 0.5.8 |
Sources
- osv: GHSA-32gc-64m7-hj7v
- https://github.com/decolua/9router/security/advisories/GHSA-32gc-64m7-hj7v
- https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3
- https://github.com/decolua/9router
- https://github.com/decolua/9router/releases/tag/v0.5.6
CVE-2026-56682 · published · modified · JSON