NPM: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

NPM: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.4...

9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

Summary 9router determines whether an incoming request originates from localhost by trusting the X-9r-Real-Ip HTTP request header. This header is intended to be produced and sanitized exclusively by the bundled custom-server.js layer from the TCP socket address. In deployment modes where requests...

9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

9router determines whether an incoming request originates from localhost by trusting the X-9r-Real-Ip HTTP request header. This header is intended to be produced and sanitized exclusively by the bundled custom-server.js layer from the TCP socket address. In deployment modes where requests reach...