9Router EUVD-2026-90447

Exploitation requires reaching 9Router's Search Endpoint and controlling the provider_options.baseUrl argument passed into the fetch path in src/shared/utils/ssrfGuard.js; per the vendor CVSS vector no authentication is required (PR:N) and default configurations are affected. To reach internal/private or cloud-metadata targets (e.g. 127.0.0.1, 169.254.169.254, link-local/ULA ranges) the attacker must defeat the pre-patch guard using one of the documented bypass classes: a trailing-dot FQDN ('localhost.'), an IPv4-mapped IPv6 address in the hex representation the URL parser normalizes to ('::ffff:7f00:1'), a hostname that merely resolves to a private address via wildcard DNS (nip.io/sslip.io or an attacker domain pointed at 127.0.0.1), or a public URL that 30x-redirects to an internal target. Limiting factors: exploitation only matters where the server has network reachability to sensitive internal services or a cloud metadata endpoint, and impact is confined to SSRF (no RCE/scope change indicated).

This is a genuine but moderate-severity SSRF (CWE-918) in the open-source decolua/9Router project. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation, which raises priority, but the impact metrics are all 'Low' (VC:L/VI:L/VA:L) with no scope change (SC:N), so this is a limited-impact SSRF rather than a path to full compromise - consistent with the 6.9 MEDIUM score. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no public exploit identified at time of analysis. The patch (PR #3723) and issue #3714 are public and describe the exact guard-bypass classes in detail (trailing-dot hostnames, IPv4-mapped IPv6 in hex form '::ffff:7f00:1', DNS rebinding via nip.io/sslip.io, and redirect-based pivots), which materially lowers the research cost to weaponize even though no POC is published. The core risk is the ability to coerce the server into fetching attacker-chosen internal URLs - notably cloud metadata endpoints (169.254.169.254) that the patch explicitly adds to its blocklist - which could escalate beyond the 'Low' confidentiality rating in cloud deployments. Net: a real but not urgent priority; patch promptly, especially for cloud-hosted instances, but this is not mass-exploited commodity-malware material.

A remote, unauthenticated attacker sends a request to 9Router's Search Endpoint and sets provider_options.baseUrl to an internal address (e.g. a cloud metadata URL or an internal admin service). Because the affected ssrfGuard in versions up to 0.5.55 fails to normalize trailing-dot FQDNs, mishandles hex-form IPv4-mapped IPv6 addresses, and does not re-validate DNS resolution or redirect targets, the attacker bypasses the guard and the server issues the forged request on their behalf. No public POC is identified, but the fixing PR #3723 publicly documents each bypass class.