CVE-2026-90711

A flaw was found in proxy-addr. When an application defines trusted proxy subnets using IPv4-mapped IPv6 addresses with an improper prefix length, the subnet parser fails open and erroneously treats all incoming network addresses as trusted. A remote, unauthenticated attacker can exploit this vulnerability by submitting a forged X-Forwarded-For header to spoof their client IP address. This flaw allows attackers to bypass IP-based access controls, rate limiting, and audit logging.

This vulnerability is rated as Important because unauthenticated remote attackers can spoof client IP addresses and circumvent security controls, such as rate limits or network access lists, by sending custom forwarding headers. Exploitation is contingent on application configurations that define reverse proxy trust subnets using IPv4-mapped IPv6 notation with short IPv4 prefix lengths. Environments configuring trusted proxies via canonical IPv4 CIDR blocks, hostnames, or default loopback addresses are not vulnerable to this behavior.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this flaw through configuration:

1. Configure trusted proxy definitions using standard IPv4 notation (such as 10.0.0.0/8) rather than IPv4-mapped IPv6 notation.
2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify ::ffff:10.0.0.0/104 instead of ::ffff:10.0.0.0/8).
3. Alternatively, sanitize or strip incoming X-Forwarded-For headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications.

Warning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections.