{"action":"Upgrade 9router to 0.4.77 or later.","affected":[{"fixed":"0.4.77","introduced":"0"}],"component":"9router","cve_ids":["CVE-2026-55501"],"ecosystem":"npm","epss":0.00515,"exploited":false,"fixed_versions":["0.4.77"],"ghsa_id":"GHSA-7cfm-pqrj-xgq7","id":"tcs_01M5KF9M3264SQXNWFN6H0BF3C","modified_at":"2026-07-06T22:11:30.120695Z","published_at":"2026-07-06T21:46:20Z","references":["https://osv.dev/vulnerability/GHSA-7cfm-pqrj-xgq7","https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7","https://github.com/decolua/9router"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-7cfm-pqrj-xgq7","url":"https://osv.dev/vulnerability/GHSA-7cfm-pqrj-xgq7"}],"summary":"9router: Login brute-force protection bypass via spoofed X-Forwarded-For header"}