{"action":"Upgrade 9router to 0.5.2 or later.","affected":[{"fixed":"0.5.2","introduced":"0"}],"component":"9router","cve_ids":["CVE-2026-56675"],"ecosystem":"npm","epss":0.00501,"exploited":false,"fixed_versions":["0.5.2"],"ghsa_id":"GHSA-x5c9-v98j-722r","id":"tcs_01M5KGH0BGZV3K93DV2PNG90WN","modified_at":"2026-09-23T18:27:57.782900279Z","published_at":"2026-09-23T18:12:26Z","references":["https://osv.dev/vulnerability/GHSA-x5c9-v98j-722r","https://github.com/decolua/9router/security/advisories/GHSA-x5c9-v98j-722r","https://nvd.nist.gov/vuln/detail/CVE-2026-56675","https://github.com/decolua/9router/commit/da667836cc7584bea0edd893de1d590c9ea279dc","https://github.com/decolua/9router","https://github.com/decolua/9router/releases/tag/v0.5.2"],"severity":{"label":"high","score":8.3},"sources":[{"source":"osv","source_id":"GHSA-x5c9-v98j-722r","url":"https://osv.dev/vulnerability/GHSA-x5c9-v98j-722r"}],"summary":"9router /v1 APIs has unauthenticated access via reverse proxy locality collapse"}