CVE-2026-90711
Received Received - Intake

IPv4-Mapped IPv6 Trust Bypass in proxy-addr

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: openjs

Description
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-90711
EUVD
EUVD-2026-78300

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-348 The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the proxy-addr Node.js module, which determines a client's IP address behind trusted proxies. Due to incorrect handling of IPv4-mapped IPv6 trust subnets with short prefixes (e.g., ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104), the module trusts all IPv4 addresses instead of the intended block. This allows unauthenticated clients to manipulate the X-Forwarded-For header, defeating IP-based access control and other security measures.

Detection Guidance

Check if your application uses proxy-addr versions 1.1.0 through 2.0.7. Review trust subnet configurations for IPv4-mapped IPv6 notation with short prefixes like ::ffff:10.0.0.0/8. Use commands to inspect installed versions: npm list proxy-addr. Test if the application improperly trusts arbitrary IPv4 addresses by sending requests with manipulated X-Forwarded-For headers.

Impact Analysis

This vulnerability allows attackers to bypass IP-based access controls, rate limiting, geolocation, and audit logging. They can spoof their IP address by manipulating the X-Forwarded-For header, potentially gaining unauthorized access or evading security restrictions.

Compliance Impact

This vulnerability undermines IP-based access controls and audit logging, which are critical for compliance with GDPR, HIPAA, and other regulations. It could lead to unauthorized access, data breaches, or failure to maintain proper audit trails, potentially violating regulatory requirements.

Mitigation Strategies

Upgrade proxy-addr to version 2.0.8 or later. If upgrading is not possible, ensure IPv4-mapped IPv6 trust subnets use a prefix length of at least 97 or switch to plain IPv4 notation for trust subnets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart