Node proxy addr: proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. (CVE-2026-90711)

proxy-addr is a Node.js module used to determine client IP addresses behind trusted reverse proxies, supporting Express's req.ip and req.ips. Versions 1.1.0 through 2.0.7 contain a fail-open vulnerability where a trust subnet written in IPv4-mapped IPv6 notation with an incorrect IPv4-sized prefix (e.g., ::ffff:10.0.0.0/8) is accepted without error but effectively trusts every IPv4 address globally. This causes the socket peer to be trusted at hop 0, allowing any unauthenticated client to supply an arbitrary X-Forwarded-For header and manipulate the client IP address the application reads. This defeats IP-based access control, rate limiting, geolocation, and audit logging mechanisms. The vulnerability was introduced in version 1.1.0 and fixed in version 2.0.8. The recommended remediation is to upgrade to proxy-addr 2.0.8 or later. As a workaround, users can ensure IPv4-mapped IPv6 trust subnets use a prefix length of at least 97 or express the range in plain IPv4 notation.

This vulnerability allows unauthenticated attackers to spoof client IP addresses by manipulating the X-Forwarded-For header, bypassing IP-based access controls, rate limiting, geolocation restrictions, and audit logging. This can lead to unauthorized access, evasion of security controls, and inaccurate logging of client activity. The vulnerability does not affect availability but has high confidentiality and integrity impacts as indicated by the CVSS score of 9.1.

A fix is available in proxy-addr version 2.0.8 and later; users should upgrade to these versions to remediate the vulnerability. As a temporary workaround, ensure that any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97 or specify the trusted range using plain IPv4 notation. No other vendor advisory information contradicts these recommendations.