CVE-2026-56681: 9Router Authentication Bypass via Spoofable X-9r-Real-Ip Header
Summary
CVE-2026-56681: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header. Affects 9router versions < 0.5.8. Fixed in 0.5.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
9Router is an open-source application designed to facilitate interactions with large language models (LLMs) through a public API. It leverages Next.js for server-side rendering and API routes, allowing users to access and manage their LLM configurations. However, it has a critical vulnerability that arises from its reliance on the X-9r-Real-Ip HTTP header for authentication, which can be spoofed by attackers.
Vulnerability Detail
The vulnerability in 9Router stems from its trust in the X-9r-Real-Ip header to determine if a request is local. This header is intended to be set by a trusted server layer, but when 9Router is deployed without this layer, an attacker can easily spoof the header to appear as a local request. This leads to unauthorized access to the public LLM API, bypassing API key requirements and potentially exposing sensitive resources and configurations. The ramifications include unauthorized use of LLM provider connections, financial losses due to consumption of paid API credits, and the risk of abuse of upstream provider accounts.
How To Fix
Latest published version: 0.5.109 as of 23 Oct 2026
npm install 9router@0.5.109Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.8
This is the first release that contains the fix.
npm install 9router@0.5.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, do not trust the X-9r-Real-Ip header or any X-9r-* headers received directly from clients. Instead, derive the client address for authorization from a trusted transport-level source, such as req.socket.remoteAddress. Implement checks to fail closed when the trusted marker is absent and explicitly strip or reject any inbound client-supplied X-9r-* headers.
Conclusion
The CVE-2026-56681 vulnerability in the 9Router application poses significant security risks due to its reliance on a spoofable HTTP header for authentication. It is crucial to update to the latest version and implement recommended workarounds to safeguard against potential exploitation.
See every vulnerability recorded for 9router →
FAQ
CVE-2026-56681 is a vulnerability in the 9Router application that allows unauthenticated remote attackers to bypass API key enforcement via a spoofable HTTP header.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
The consequences include unauthorized access to LLM resources, potential financial loss due to API usage, and the risk of abuse of upstream provider accounts.
You can update the 9Router package to the patched version by running the command: npm install 9router@0.5.8.
If immediate updating is not possible, implement the suggested workarounds to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for 9router.
