CVE-2026-90711
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
proxy-addr determines which network hops are trusted proxies so that X-Forwarded-For can be believed. When an application configures a trust subnet as an IPv4-mapped IPv6 address with a short prefix, such as ::ffff:10.0.0.0/8 (the correct spelling is ::ffff:10.0.0.0/104), the subnet compiles with all-zero leading bits and matches every IPv4 address instead of the block it names.
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v3.1)
- EPSS
- 0.26% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- proxy-addr (npm) >= 1.1.0, < 2.0.8, fixed in 2.0.8 · GHSA-jqcg-44mw-7w3h