Skip to content
OpenAdvisories

Package · npm

9router

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-56682

    9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

    9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordF…

    decolua 9Router 9router npm
  • Medium 6.4
    CVE-2026-56678

    9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

    9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-ca…

    decolua 9Router 9router npm