EUVD-2026-42929Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Authenticated proxy user (PR:L) over the network; winning the DNS rebind race raises AC:H; SSRF pivots to internal systems (S:C) with limited read/write and no availability impact (A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and then rebinds to an internal address, allowing server-side requests to internal-only HTTP services. This issue is fixed in version 0.5.2.
AnalysisAI
Server-side request forgery via DNS rebinding in 9Router (decolua/9router) before 0.5.2 allows an authenticated LLM-proxy user to reach internal-only HTTP services. The image-URL validation resolves the host once to a public IP, but open-sse/translator/concerns/image.js performs the actual server-side fetch with a separate DNS lookup, so an attacker-controlled name can rebind to an internal address between the two resolutions. No public exploit identified at time of analysis; the flaw is fixed in 0.5.2.
Technical ContextAI
9Router is a Node.js-based AI/LLM router and token-saving proxy. Vision-capable models accept image URLs, which the server fetches on the user's behalf. The root cause is CWE-367 (Time-of-check to Time-of-use): the security check (DNS resolution used to validate that the host maps to a public IP) and the security-sensitive action (the real image fetch in open-sse/translator/concerns/image.js) each perform their own independent DNS resolution. Because the check and use are not bound to the same resolved address, an attacker-controlled authoritative DNS server can return a public IP during validation and an internal RFC1918 address during the fetch (classic DNS rebinding), converting the trusted image-fetch path into an SSRF primitive against localhost and internal HTTP services. The only affected package is cpe:2.3:a:decolua:9router.
RemediationAI
Vendor-released patch: upgrade 9router to version 0.5.2 or later (release https://github.com/decolua/9router/releases/tag/v0.5.2, fix commit c7d07448c58bec1200741de0b73305b860416b82, advisory GHSA-cmhj-wh2f-9cgx). If immediate upgrade is not possible, apply compensating controls: pin the fetch to the exact IP validated during the check (resolve once and reuse the address) or route outbound image fetches through an egress proxy that blocks RFC1918/loopback/link-local and metadata (169.254.169.254) destinations - the trade-off is that legitimately internal image URLs will break. Additionally, disable or restrict vision-capable model routes for untrusted proxy users, and enforce network egress filtering so the 9router host cannot reach internal-only HTTP services; the side effect is reduced functionality for any workflow that legitimately fetches internal images.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credential
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe interna
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded de
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access t
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the h
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read ev
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable applicatio
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach p
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: lo
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today