CVE-2026-63313 Details
Description
9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa) to fetch content. The URL is only validated as syntactically valid via new URL() with no blocklist for private IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), link-local addresses, or internal hostnames. An authenticated or locally-connected user can cause the server to fetch arbitrary internal URLs and have the response content returned, enabling read-access SSRF that can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.
A server-side request forgery (SSRF) vulnerability has been identified in 9Router versions prior to 0.4.72. The issue resides in the '/v1/web/fetch' endpoint, which allows authenticated or locally-connected users to send requests to internal URLs via external scraping providers. The endpoint fails to properly validate the 'url' parameter, allowing requests to private IP ranges, cloud metadata endpoints, link-local addresses, and internal hostnames. This vulnerability could be exploited to access sensitive cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.
Users are advised to update to 9Router version 0.4.72 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 23, 2026CISA-ADP
Assessed Jul 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/decolua/9router/security/advisories/GHSA-qj3v-64wj-q825 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/decolua/9router/security/advisories/GHSA-qj3v-64wj-q825 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/9router-before-server-side-request-forgery-via-v1-web-fetch | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| decolua 9router | <= 0.4.71 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |