CVE-2026-56681

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.6

Description Deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header. In src/dashboardGuard.js, the isLocalRequest() function uses this header to determine if a request originates from localhost. If the header is set to 127.0.0.1, the canAccessPublicLlmApi() function may skip API-key validation for routes under the /api/v1/* endpoint, such as the GET /api/v1/models route. A remote unauthenticated attacker can exploit this by spoofing the X-9r-Real-Ip header to be classified as a local client, allowing unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models.

Recommendations Update to version 0.5.6. As a temporary mitigation, ensure the custom-server.js wrapper is used to sanitize requests or restrict access to the /api/v1/* endpoint to prevent remote attackers from supplying the X-9r-Real-Ip header.