VulnSocial

CVE-2026-90711Patch

LOWCVSS 9.1 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-290CWE-348CWE-697

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 4 signals
  • Peaked 1d ago at 2 mentions (2026-09-15); latest day: 2
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-09-15: 2Mentions · 2026-09-16: 2Patch / Workaround · 2026-09-15: 2Patch / Workaround · 2026-09-16: 2Technical Details · 2026-09-15: 2Technical Details · 2026-09-16: 209-1509-16
Signal classification1 categories
Patch
4100.0%
Referenced assets4 URLs
Full discourse4 posts
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    A critical proxy-addr IP spoofing flaw (CVE-2026-90711) exposes Node.js apps to access control bypasses. Patch this proxy-addr IP spoofing bug today. #ProxyAddr #NodeJS #IPspoofing #CVE202690711 #Cybersecurity https://securityonline.info/proxy-addr-ip-spoofing-flaw/

    Post summary

    The text announces CVE-2026-90711, describes its technical impact on Node.js apps, and explicitly urges patching, qualifying it as a Patch-focused disclosure.

    050102495
    13.0K followersView on X
  • NEXSIGHT@NEXSIGHTNEWS
    Patch

    Node.jsの「proxy-addr」にIPアドレス偽装の脆弱性CVE-2026-90711 — 「::ffff:10.0.0.0/8」のような指定でインターネット上の全IPv4を信頼、Expressのreq.ipも影響、2.0.8で修正 https://cyber.nexsight.co/articles/2026/09/16/proxy-addr-cve-2026-90711-ip-spoofing-2026-09-16/

    Post summary

    The text discloses CVE-2026-90711, a proxy-addr IP spoofing issue affecting Express req.ip, and states that it is fixed in version 2.0.8. The main actionable information is the available fix.

    0000049
    71 followersView on X
  • Severity Daily@severitydaily
    Patch

    proxy-addr 2.0.8 fixes a trust list where ::ffff:10.0.0.0/8 matched all of IPv4 — Express's req.ip then returned whatever the client sent. Only apps using IPv4-mapped IPv6 trust subnets were affected. No exploitation reported. https://severitydaily.com/proxy-addr-ipv4-mapped-ipv6-trust-subnet-cve-2026-90711/

    Post summary

    The proxy-addr vulnerability allowed IPv4-mapped IPv6 trust subnets to be bypassed, which is fixed in version 2.0.8; no active exploitation has been reported.

    0000039
    24 followersView on X
  • Ulises Gascón@kom_256
    Patch

    🚨 Critical-severity security fix in proxy-addr@2.0.8 just released! Patches CVE-2026-90711: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h

    Post summary

    The tweet announces a critical security fix (v2.0.8) for CVE-2026-90711 in proxy-addr, explicitly stating it patches an IP spoofing vulnerability and providing a link to the advisory.

    00000201
    5.5K followersView on X

Explore more

Back to dashboard