CVE-2026-90711: proxy-addr IP Spoofing Vulnerability via IPv4-Mapped IPv6 Trust Subnet
Summary
CVE-2026-90711: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet. Affects proxy-addr versions >= 1.1.0, < 2.0.8. Fixed in 2.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
proxy-addr is a middleware for Node.js applications that helps determine which network hops are trusted proxies for the purpose of validating the 'X-Forwarded-For' header. It is commonly used in web applications to manage client IP addresses effectively. However, a misconfiguration in trust subnets can lead to severe security implications, allowing unauthorized access and manipulation of client IP data.
Vulnerability Detail
The vulnerability arises when an application incorrectly configures a trust subnet as an IPv4-mapped IPv6 address with a short prefix, such as '::ffff:10.0.0.0/8'. This configuration erroneously matches all IPv4 addresses due to leading zero bits, thus trusting every unauthenticated client as a proxy. As a result, the application can be exploited, leading to IP-based access control failures, rate limiting bypass, and compromised audit logging. The issue is subtle, as the misconfiguration does not trigger any errors, making it difficult to detect.
How To Fix
Latest published version: 2.0.8 as of 22 Oct 2026
npm install proxy-addr@2.0.8The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, you can use the following workaround: configure IPv4 trust subnets in plain IPv4 notation, such as '10.0.0.0/8'. If IPv4-mapped IPv6 notation is necessary, ensure to use the full form, for example, '::ffff:10.0.0.0/104' for the '10.0.0.0/8' block.
Conclusion
The proxy-addr vulnerability (CVE-2026-90711) poses a significant risk due to improper trust subnet configurations that can lead to IP spoofing. It is crucial to upgrade to version 2.0.8 or apply the recommended workarounds to safeguard your application from potential exploits.
See every vulnerability recorded for proxy-addr →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The consequences include unauthorized access to sensitive data, bypassing of security measures, and potential data manipulation due to incorrect trust configurations.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing your package-lock.json.
If an upgrade is not feasible, implement the suggested workarounds to mitigate the risk until you can update to the patched version.
