9router (npm)
Advisories
17
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.5.8 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install 9router@0.5.8yarn
yarn add 9router@0.5.8pnpm
pnpm add 9router@0.5.8Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-32gc-64m7-hj7v 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header |
Medium EPSS 0.50% |
< 0.5.8 | 0.5.8 |
| GHSA-5mj8-gf6m-fhw8 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header |
High EPSS 1.11% |
< 0.5.8 | 0.5.8 |
| GHSA-8g4w-4ffg-8vgx 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint |
High EPSS 0.38% |
<= 0.5.4 | No fix yet |
| GHSA-vmjq-hvgq-2wv4 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade |
High EPSS 0.40% |
< 0.5.4 | 0.5.4 |
| GHSA-6mwv-4mrm-5p3m 9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding |
Medium EPSS 0.21% |
< 0.5.6 | 0.5.6 |
| GHSA-x5c9-v98j-722r 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse |
High EPSS 0.50% |
< 0.5.2 | 0.5.2 |
| GHSA-86m2-fcxq-5q7c 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF |
High EPSS 0.33% |
< 0.5.2 | 0.5.2 |
| GHSA-8gmq-j984-vp4r 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass |
High EPSS 6.58% |
< 0.5.2 | 0.5.2 |
| GHSA-cmhj-wh2f-9cgx 9router: Image prefetch DNS rebinding allows SSRF to internal services |
High EPSS 0.19% |
< 0.5.2 | 0.5.2 |
| GHSA-7cfm-pqrj-xgq7 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header |
High EPSS 0.38% |
< 0.4.77 | 0.4.77 |
| GHSA-qvfm-67h2-2qfx 9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover |
Critical EPSS 0.48% |
<= 0.4.71 | No fix yet |
| GHSA-vjc7-jrh9-9j86 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats |
Critical EPSS 6.27% |
<= 0.4.41 | No fix yet |
| GHSA-6g2f-w7g3-77vf 9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING |
High EPSS 0.34% |
<= 0.4.55 | No fix yet |
| GHSA-jphh-m39h-6gwx 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass |
Critical EPSS 0.60% |
>= 0.2.21, < 0.4.45 | 0.4.45 |
| GHSA-g6g7-pvmx-m74p 9router: Missing Authorization and OS Command Injection |
Critical EPSS 2.08% |
< 0.4.44 | 0.4.44 |
| GHSA-fhh6-4qxv-rpqj 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes |
Critical EPSS 2.76% |
>= 0.4.30, < 0.4.37 | 0.4.37 |
| GHSA-xrrh-p7f2-27vm decolua 9router vulnerable to authorization bypass |
High EPSS 0.39% |
< 0.3.75 | 0.3.75 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor