---
title: "GHSA-vjc7-jrh9-9j86: 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats"
url: https://erroneo.us/security/ghsa/GHSA-vjc7-jrh9-9j86/
description: "GHSA-vjc7-jrh9-9j86 (critical, npm): 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats. --- title…"
type: advisory
section: "Security Digest"
date_published: 2026-07-06
date_modified: 2026-07-06
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-vjc7-jrh9-9j86"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-vjc7-jrh9-9j86: 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats

## Affected packages

- npm `9router` <= 0.4.41 → fixed: none listed

## Details

--- title: Unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats product: 9Router version:

## Sources

- [GitHub Advisory GHSA-vjc7-jrh9-9j86](https://github.com/advisories/GHSA-vjc7-jrh9-9j86)
- [github.com](https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86)

---
Source page: https://erroneo.us/security/ghsa/GHSA-vjc7-jrh9-9j86/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt