HIGH 7.4 GitHub
CVE-2026-56676
9router: Image prefetch DNS rebinding allows SSRF to internal services
## Summary
9router validates image URLs by resolving the host before fetching, but the later
server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can
resolve to a public IP during validation and then rebind to an internal Docker/private IP
during the fetch. This allows the server-side image prefetch to reach internal-only HTTP
services (SSRF).
## Details
- **Affected version / commit:** 9router `v0.4.80` @ `b282f05`.
- **Reachable through** `/v1/chat/completio
Affected Products
- npm/9router <= 0.4.80
References
- https://github.com/advisories/GHSA-cmhj-wh2f-9cgx
- https://github.com/decolua/9router/security/advisories/GHSA-cmhj-wh2f-9cgx
- https://nvd.nist.gov/vuln/detail/CVE-2026-56676
- https://github.com/decolua/9router/commit/c7d07448c58bec1200741de0b73305b860416b82
This high severity vulnerability with a CVSS score of 7.4 was published on 2026-09-23 via GitHub. Affected: npm/9router <= 0.4.80.
vulnfeed aggregates 12908 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.