CVE-2026-56679: 9router Mass Assignment Vulnerability Allows Authentication Downgrade
Summary
CVE-2026-56679: 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade. Affects 9router versions < 0.5.4. Fixed in 0.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
9router is an open-source application designed to manage and route network traffic efficiently. It provides various functionalities, including API access for managing settings and user authentication. However, it has a critical vulnerability that allows authenticated users to modify security-sensitive settings without proper restrictions, leading to potential unauthorized access.
Vulnerability Detail
The vulnerability arises from a mass assignment issue in the PATCH /api/settings endpoint, where the entire request body is written to persistent settings without a field whitelist. This allows an authenticated user to modify critical fields, such as requireLogin, which can disable authentication for the entire application. The root cause is unfiltered mass assignment (CWE-915), where any key in the request body can overwrite stored settings. This can lead to unauthorized access to protected routes, exposing sensitive data and functionalities.
How To Fix
Latest published version: 0.5.109 as of 23 Oct 2026
npm install 9router@0.5.109Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.4
This is the first release that contains the fix.
npm install 9router@0.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the PATCH /api/settings endpoint until the package is updated. Regularly monitor your application for unauthorized changes to settings and ensure that sensitive routes are protected.
Conclusion
The CVE-2026-56679 vulnerability in the 9router package poses a significant risk by allowing authenticated users to disable authentication and access sensitive data. It is crucial to update to the patched version and implement recommended security measures to mitigate this risk.
See every vulnerability recorded for 9router →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Any authenticated user of the 9router application can exploit this vulnerability, especially those using default credentials.
Exploiting this vulnerability can lead to unauthorized access to sensitive data, including API keys and provider connection data, allowing attackers to fully compromise the application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a monitoring tool that uses package-lock.json to alert users in real-time about open-source vulnerabilities in their software.
References
Related vulnerabilities
Recent vulnerabilities recorded for 9router.
