{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.4.41"}],"component":"9router","cve_ids":["CVE-2026-59801","CVE-2026-62327","CVE-2026-62328"],"ecosystem":"npm","epss":0.02619,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-vjc7-jrh9-9j86","id":"tcs_01M5KGC4ZAFG6TZPBQ199N4J8Z","modified_at":"2026-07-15T02:26:45.233399556Z","published_at":"2026-07-06T21:22:10Z","references":["https://osv.dev/vulnerability/GHSA-vjc7-jrh9-9j86","https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86","https://github.com/decolua/9router"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-vjc7-jrh9-9j86","url":"https://osv.dev/vulnerability/GHSA-vjc7-jrh9-9j86"}],"summary":"9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats"}