| Package | Affected versions | Patched versions |
|---|---|---|
| 9router | < 0.5.8 | 0.5.8 |
9router determines whether an incoming request originates from localhost by trusting the X-9r-Real-Ip HTTP request header. This header is intended to be produced and sanitized exclusively by the bundled custom-server.js layer from the TCP socket address. In deployment modes where requests reach Next.js directly (the header is never stripped/regenerated), a remote, unauthenticated attacker can simply send X-9r-Real-Ip: 127.0.0.1 and be treated as a local client. This bypasses the API-key requirement on the public LLM API (/api/v1/*), granting unauthenticated access to the instance owner's configured provider resources.
The authorization layer makes a security decision based on a client-controllable HTTP header. isLocalRequest() reads X-9r-Real-Ip and, if its value is a loopback address (127.0.0.1), classifies the request as local. The design assumes this header can only be set by the trusted custom-server.js wrapper (which derives it from the unspoofable socket address and strips any inbound copy). When the application is served without that wrapper, Next.js passes the attacker-supplied header through unchanged, so the trust assumption is violated:
Untrusted Client Input
↓
X-9r-Real-Ip: 127.0.0.1
↓
isLocalRequest() → true
↓
canAccessPublicLlmApi() → allowed (API key not required)
↓
200 OK
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeThe only difference between the two requests is the addition of X-9r-Real-Ip: 127.0.0.1.
An unauthenticated remote attacker who can reach the service can bypass API-key enforcement on the public LLM API and act as a trusted local client. Consequences include: