CVE-2026-56676: 9router: Image prefetch DNS rebinding allows SSRF to internal services

September 23, 2026

9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can resolve to a public IP during validation and then rebind to an internal Docker/private IP during the fetch. This allows the server-side image prefetch to reach internal-only HTTP services (SSRF).

References

github.com/advisories/GHSA-cmhj-wh2f-9cgx
github.com/decolua/9router/commit/c7d07448c58bec1200741de0b73305b860416b82
github.com/decolua/9router/releases/tag/v0.5.2
github.com/decolua/9router/security/advisories/GHSA-cmhj-wh2f-9cgx
nvd.nist.gov/vuln/detail/CVE-2026-56676

Code Behaviors & Features

Detect and mitigate CVE-2026-56676 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →