CVE-2026-56675: 9router Unauthenticated Access via Reverse Proxy Locality Collapse
Summary
CVE-2026-56675: 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse. Affects 9router versions < 0.5.2. Fixed in 0.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
9router is an open-source routing software designed to facilitate API management and routing for various backend services. It is commonly deployed in cloud environments and supports reverse proxy configurations, allowing it to handle incoming requests and route them to appropriate backend services. However, a significant vulnerability has been identified that allows unauthenticated access to its APIs under specific deployment conditions.
Vulnerability Detail
The vulnerability arises from 9router's treatment of local loopback requests as trusted, allowing access to its /v1 APIs without requiring an API key. In typical reverse proxy setups, such as those using nginx to forward public traffic to the backend via 127.0.0.1, external requests are misclassified as local. This misclassification leads to unauthorized access to sensitive endpoints like /v1/models, potentially allowing attackers to abuse upstream provider credentials configured in the system. The root cause is the backend's reliance on perceived socket locality after reverse proxying, ignoring forwarded headers that indicate the true client IP.
How To Fix
Latest published version: 0.5.109 as of 23 Oct 2026
npm install 9router@0.5.109Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.2
This is the first release that contains the fix.
npm install 9router@0.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using client or proxy socket IP locality as an authentication mechanism. Instead, bind local trust to a secure server-generated secret or use Unix domain sockets that are only accessible locally. This can help mitigate the risk until a proper fix is implemented.
Conclusion
The CVE-2026-56675 vulnerability in 9router poses a significant risk by allowing unauthenticated access to its APIs through misconfigured reverse proxy setups. It is crucial for users to update to the latest version and implement recommended security practices to mitigate this risk.
See every vulnerability recorded for 9router →
FAQ
CVE-2026-56675 is a vulnerability in the 9router package that allows unauthenticated access to its APIs due to improper handling of loopback requests in reverse proxy configurations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive API endpoints, model enumeration, and potential abuse of upstream provider credentials, which could incur costs for the operator.
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
Ensure that you update to version 0.5.2 or later of 9router, enforce API key requirements for public endpoints, and configure trusted proxy settings to accurately derive client IP addresses.
References
Related vulnerabilities
Recent vulnerabilities recorded for 9router.
