Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90711— proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Quick assessment

Affected
proxy-addr proxy-addr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是一个 Node.js 模块，用于确定经过可信反向代理后的客户端地址，并为 Express 中的 和 提供底层支持。在 1.1.0 至 2.0.7 版本中，若以 IPv4 映射的 IPv6 表示法书写信任子网，且使用了 IPv4 大小的前缀（例如使用 而非正确的 ），该配置虽不会报错，但实际上会信任互联网上所有 IPv4 地址，而非其本应指定的网段。由于套接字对端地址因此在第 0 跳即被视为可信，任何未认证客户端都可以提供任意的 头部，从而控制应用程序所读取的客户端地址。这会导致基于 IP 的访问控制、速率限制、地

CVSS 9.1 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90711

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
Source: CVE Program / CVE List V5
Vulnerability Description
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
proxy-addr proxy-addr 1.1.0 ~ 2.0.8 -

II. Public POCs for CVE-2026-90711

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90711

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-90711 (1)

IV. Related Vulnerabilities

Same weakness: CWE-290

V. Comments for CVE-2026-90711

No comments yet

Leave a comment