CVE-2026-56676: 9router Image Prefetch DNS Rebinding Vulnerability Leading to SSRF
Summary
CVE-2026-56676: 9router: Image prefetch DNS rebinding allows SSRF to internal services. Affects 9router versions < 0.5.2. Fixed in 0.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
9router is an open-source package designed for facilitating chat completions with vision-capable models. It allows users to send requests that include image URLs for processing. However, the package has a vulnerability that arises from improper DNS resolution during image fetching, making it susceptible to DNS rebinding attacks.
Vulnerability Detail
The vulnerability in 9router stems from its method of validating image URLs by resolving the host before fetching. However, during the actual server-side fetch, a separate DNS resolution occurs. An attacker can exploit this by initially resolving a controlled DNS name to a public IP, then rebinding it to an internal IP during the fetch. This allows the server-side image prefetch to access internal-only HTTP services, leading to Server-Side Request Forgery (SSRF) attacks. The root cause is a Time-of-Check to Time-of-Use (TOCTOU) issue, where the IP is not pinned between the validation and fetch processes.
How To Fix
Latest published version: 0.5.109 as of 23 Oct 2026
npm install 9router@0.5.109Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.2
This is the first release that contains the fix.
npm install 9router@0.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks to block private, loopback, link-local, multicast, and cloud-metadata ranges at connect time. This can help mitigate the risk until the package is updated.
Conclusion
The CVE-2026-56676 vulnerability in the 9router package poses a significant risk due to its potential for SSRF attacks. It is crucial to update to the patched version 0.5.2 to mitigate this risk. Additionally, implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for 9router →
FAQ
CVE-2026-56676 is a vulnerability in the 9router package that allows DNS rebinding attacks, leading to SSRF.
Exploitation of this vulnerability can allow attackers to access internal services that should not be exposed, potentially leading to data leaks or unauthorized access.
Server-Side Request Forgery (SSRF) is a type of attack where an attacker can make requests from the server to internal or external resources, often bypassing security controls.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without signup.
The CVSS score for CVE-2026-56676 is 7.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for 9router.
