{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.4.71"}],"component":"9router","cve_ids":["CVE-2026-55500"],"ecosystem":"npm","epss":0.0048,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-qvfm-67h2-2qfx","id":"tcs_01M5KG7505RPWG55EYJ8WF9A16","modified_at":"2026-07-06T21:56:32.487399Z","published_at":"2026-07-06T21:37:49Z","references":["https://osv.dev/vulnerability/GHSA-qvfm-67h2-2qfx","https://github.com/decolua/9router/security/advisories/GHSA-qvfm-67h2-2qfx","https://github.com/decolua/9router"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-qvfm-67h2-2qfx","url":"https://osv.dev/vulnerability/GHSA-qvfm-67h2-2qfx"}],"summary":"9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover"}