CVE-2026-56675: 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

September 23, 2026

9router treats local loopback requests as trusted and allows access to /v1/* without an API key. In a documented/common reverse-proxy deployment where nginx forwards public traffic to the backend via 127.0.0.1, external non-Origin requests are misclassified as local. This allows unauthenticated access to /v1 APIs such as /v1/models, and may allow abuse of configured upstream provider credentials depending on the enabled providers.

References

github.com/advisories/GHSA-x5c9-v98j-722r
github.com/decolua/9router/commit/da667836cc7584bea0edd893de1d590c9ea279dc
github.com/decolua/9router/releases/tag/v0.5.2
github.com/decolua/9router/security/advisories/GHSA-x5c9-v98j-722r
nvd.nist.gov/vuln/detail/CVE-2026-56675

Code Behaviors & Features

Detect and mitigate CVE-2026-56675 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →