CVE-2026-90711

The proxy-addr Node.js module, which backs Express's req.ip and req.ips handling, incorrectly accepts a trusted proxy subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g., ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104), silently trusting every IPv4 address on the internet instead of the intended block. An unauthenticated remote attacker can exploit this by sending an arbitrary X-Forwarded-For header, which the application then trusts as the client address, defeating IP-based access controls, rate limiting, geolocation, and audit logging. The regression was introduced in proxy-addr 1.1.0 and affects all versions through 2.0.7, so any Express or other Node.js deployment that configures trust subnets in this notation is affected. The flaw is rated critical (CVSS 9.1) due to high confidentiality and integrity impact with no privileges or user interaction required. No public proof of concept exists and there is no evidence of in-the-wild exploitation, and it is not on the CISA KEV list.

What to do: Upgrade proxy-addr to 2.0.8 or later by refreshing lockfiles (npm update proxy-addr / Dependabot). Audit Express 'trust proxy' configurations for IPv4-mapped IPv6 subnets such as ::ffff:10.0.0.0/8; as an interim workaround, rewrite them with a prefix length of at least 97 (e.g., ::ffff:10.0.0.0/104) or use plain IPv4 CIDR notation. Review access-control decisions, rate-limit counters, and audit logs for suspicious or rapidly changing X-Forwarded-For values that could indicate attempted spoofing.