Am I affected by 9Router authentication bypass via spoofable X-9r-Real-Ip header? What should I do?

Question

9router decides a request comes from the local machine by trusting the X-9r-Real-Ip header that the client sends.

Affected: 9router <= 0.5.4. Fixed in: 0.5.8. What should you check, and what should you do about it?

Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/cve-2026-56681-9router-9router-app

AgentArmor team · Accepted Answer

**Am I affected?**
Affected: 9router <= 0.5.4. Fixed in: 0.5.8.
- Check your version: run `npm ls 9router`. Versions <= 0.5.4 of 9router are affected.

**What to do now**
1. Upgrade to the fixed version: run `npm install 9router@0.5.8` (first patched version 0.5.8).
2. Run the app only in a supported secure startup mode where clients cannot control the X-9r-Real-Ip header.
3. Strip or reject any inbound X-9r-* headers at the edge.

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

**Sources**
- GitHub Advisory Database: https://github.com/advisories/GHSA-5mj8-gf6m-fhw8

Full incident page: https://agentarmorhq.com/incidents/2026/09/cve-2026-56681-9router-9router-app

Am I affected by 9Router authentication bypass via spoofable X-9r-Real-Ip header? What should I do?

1 answer

Add your answer or comment