01 Record

CVE-2026-72860

9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

MediumPUBLISHEDCNA: VulnCheck

Base score6.3 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

02 Description

9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

Published

2026-08-20 21:35Z1 DAY AGO

Last updated

2026-08-21 11:21Z14 HR AGO

Reserved

2026-08-10

Assigning CNA

VulnCheck

Record state

PUBLISHED

Severity

Medium (CVSS 6.3)

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N

Weaknesses

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

710022c42f67278c194d6722f1dfe7f636c15b5c1b6eb847cd542a6625889a52

VendorProductVersionsPlatforms

decolua9router0 to 0.5.55—

github.comGitHub Issue #3293https://github.com/decolua/9router/issues/3293issue-tracking
github.comassertPublicUrl and the unreachable IPv4-mapped branch in isBlockedIpv6https://github.com/decolua/9router/blob/master/src/shared/utils/ssrfGuard.jstechnical-description
github.comvalidate route applying the guard and reflecting 200 byteshttps://github.com/decolua/9router/blob/master/src/app/api/provider-nodes/validate/route.jstechnical-description
github.comProposed fix judging mapped addresses by address rather than spelling (not merged)https://github.com/decolua/9router/pull/3370issue-tracking
github.comhttps://github.com/decolua/9routerproduct
www.vulncheck.comVulnCheck Advisory: 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachablehttps://www.vulncheck.com/advisories/9router-server-side-request-forgery-via-api-provider-nodes-validate-because-the-ipv4-mapped-ipv6-denylist-check-is-unreachablethird-party-advisory