CVE-2026-92395

A flaw in @fastify/proxy-addr versions 3.0.0 through 5.1.0, the Fastify plugin that computes request.ip and request.ips, causes trust subnets written in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g., ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104) to be silently accepted as trusting every IPv4 address on the internet. In that configuration the direct socket peer is trusted at hop 0, so any unauthenticated client can supply an arbitrary X-Forwarded-For header and fully control the client address the application reads. An attacker can thereby defeat IP-based access control, rate limiting, geolocation, and audit logging. Only Fastify applications on affected plugin versions that define a trust proxy subnet in IPv4-mapped IPv6 notation with a prefix shorter than 97 bits are exploitable; the defect was inherited from the upstream proxy-addr module (CVE-2026-90711). No exploitation in the wild and no public proof-of-concept are known, and a fix is available in version 5.1.1.

What to do: Upgrade @fastify/proxy-addr to 5.1.1 or later (and apply the upstream proxy-addr fix referenced by CVE-2026-90711 if that module is used directly). Audit trustProxy settings and replace any IPv4-mapped IPv6 subnet with a prefix shorter than 97 bits using a prefix of at least 97 (e.g., /104) or plain IPv4 notation such as 10.0.0.0/8. Until patched, avoid relying on request.ip for IP allowlists, rate limiting, or audit logging.