---
id: CVE-2026-72860
title: >-
  The POST /api/provider-nodes/validate route in 9router takes a caller-supplied
  baseUrl and issues server-side HTTP requests to it, guarding the destination
  with assertPublicUrl from src/shared/utils/ssrfGuard.js
summary: >-
  The POST /api/provider-nodes/validate route in 9router takes a caller-supplied
  baseUrl and issues server-side HTTP requests to it, guarding the destination
  with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares
  host…
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
cwe:
  - CWE-184
  - CWE-918
published: '2026-08-20'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T13:42:43.990'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72860'
references:
  - url: 'https://github.com/decolua/9router'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/decolua/9router/blob/master/src/app/api/provider-nodes/validate/route.js
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/decolua/9router/blob/master/src/shared/utils/ssrfGuard.js
    label: disclosure@vulncheck.com
  - url: 'https://github.com/decolua/9router/issues/3293'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/decolua/9router/pull/3370'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/9router-server-side-request-forgery-via-api-provider-nodes-validate-because-the-ipv4-mapped-ipv6-denylist-check-is-unreachable
    label: disclosure@vulncheck.com
  - url: 'https://github.com/decolua/9router/issues/3293'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00384
epssPercentile: 0.29805
ingestedAt: '2026-09-16T13:56:12.596Z'
vendor: decolua
product: 9router
affected:
  - 9router <= 0.5.55
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-25T15:26:55.977320Z'
---

## Overview

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate after a redirect, and its IPv4-mapped IPv6 branch is unreachable. The branch matches ^::ffff:(\d+\.\d+\.\d+\.\d+)$, but the WHATWG URL parser canonicalizes such literals to hextets before the guard runs, so new URL("http://[::ffff:127.0.0.1]/").hostname yields [::ffff:7f00:1] and the pattern is tested against a string it is never handed. Every IPv4-mapped address therefore passes, and http://[::ffff:7f00:1] and http://[::ffff:a9fe:a9fe] reach loopback and link-local metadata addresses; a hostname whose A record points at an internal address passes as well because no resolution occurs. In the custom-embedding branch the upstream response body is truncated to 200 bytes and returned to the caller whenever the upstream status is neither 2xx nor 401 nor 403, which discloses the beginning of internal responses, and the other validation types remain usable for blind internal port scanning through status and timing differences. The caller-supplied apiKey is forwarded to the internal destination as an Authorization Bearer header. A dashboard session is required by default, and none is required when requireLogin is disabled.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.