CVE-2026-56676: Decolua 9router

High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days.

9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and then rebinds to an internal address, allowing server-side requests to internal-only HTTP services. This issue is fixed in version 0.5.2.

Affected products

• Decolua 9router: before 0.5.2 (fixed in 0.5.2)

Published 2026-07-10. Last modified 2026-07-13.