{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.5.4"}],"component":"9router","cve_ids":["CVE-2026-56677"],"ecosystem":"npm","epss":0.00375,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-8g4w-4ffg-8vgx","id":"tcs_01M5KFCTK24XEQ6WJQXJD6ZHMG","modified_at":"2026-08-17T22:11:02.180370Z","published_at":"2026-08-17T21:58:43Z","references":["https://osv.dev/vulnerability/GHSA-8g4w-4ffg-8vgx","https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx","https://github.com/decolua/9router"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-8g4w-4ffg-8vgx","url":"https://osv.dev/vulnerability/GHSA-8g4w-4ffg-8vgx"}],"summary":"9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint"}