CVE-2026-90711 Overview
CVE-2026-90711 is an authentication bypass vulnerability in proxy-addr, a Node.js module that determines a request's client address behind trusted reverse proxies. The module backs Express req.ip and req.ips. Versions 1.1.0 through 2.0.7 accept malformed IPv4-mapped IPv6 trust subnets without error. A prefix such as ::ffff:10.0.0.0/8 is interpreted as trusting every IPv4 address on the internet instead of the intended 10.0.0.0/8 block. The flaw is tracked under [CWE-290: Authentication Bypass by Spoofing]. It is fixed in proxy-addr 2.0.8.
Critical Impact
Any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the client IP address the application reads, defeating IP-based access control, rate limiting, geolocation, and audit logging.
Affected Products
- proxy-addr versions 1.1.0 through 2.0.7
- Express applications relying on req.ip and req.ips behind trusted proxies
- Any Node.js service using proxy-addr with an IPv4-mapped IPv6 trust subnet containing an IPv4-sized prefix
Discovery Timeline
- 2026-09-15 - CVE-2026-90711 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90711
Vulnerability Analysis
The proxy-addr module accepts trust configurations that describe which upstream proxies are permitted to set forwarded client address headers. When an operator supplies an IPv4-mapped IPv6 subnet, the prefix length must reflect the full 128-bit IPv6 address space. IPv4-mapped addresses occupy the last 32 bits of an IPv6 address, so an IPv4 /8 translates to an IPv6 /104.
Versions 1.1.0 through 2.0.7 accept an incorrect prefix such as ::ffff:10.0.0.0/8 without validation error. The resulting mask covers nearly the entire IPv6 address space, causing the socket peer to be treated as trusted at hop 0. Once the peer is trusted, proxy-addr walks the X-Forwarded-For chain and returns the attacker-controlled value as the client IP.
This is a fail-open regression introduced in version 1.1.0. Applications that previously enforced narrow trust boundaries silently trust every inbound connection after the misconfiguration is applied.
Root Cause
The root cause is missing validation of prefix length semantics when converting IPv4-sized CIDR notation into an IPv6 subnet mask. The parser accepts the shorter prefix as valid rather than rejecting it or normalizing it to /104. See GitHub Security Advisory GHSA-jqcg-44mw-7w3h for the maintainer analysis.
Attack Vector
An unauthenticated remote attacker sends an HTTP request to a vulnerable Express application. Because the socket peer is treated as trusted, the attacker injects an X-Forwarded-For header containing any IP address. The application then reads that spoofed value from req.ip. This defeats IP allowlists on administrative endpoints, bypasses per-IP rate limiting, falsifies geolocation decisions, and pollutes audit logs with attacker-chosen source addresses.
No exploit code is required beyond crafting an HTTP request with a chosen X-Forwarded-For header value. See the OpenJS Foundation Security Advisories for coordinated disclosure details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-90711
Indicators of Compromise
- HTTP requests containing X-Forwarded-For headers with values inconsistent with the observed TCP source address at the edge.
- Audit log entries where the recorded client IP is inside a sensitive internal range but the connecting session originated externally.
- Successful access to IP-restricted administrative routes from unexpected geographic regions.
Detection Strategies
- Inventory Node.js dependencies for proxy-addr versions 1.1.0 through 2.0.7 using npm ls proxy-addr or software composition analysis tooling.
- Grep application configuration and Express app.set('trust proxy', ...) values for IPv4-mapped IPv6 CIDRs whose prefix length is below 97, such as ::ffff:10.0.0.0/8.
- Correlate reverse proxy access logs with application logs to detect divergence between the true peer address and the address recorded by the application.
Monitoring Recommendations
- Alert on requests to authentication, admin, or billing endpoints where req.ip resolves to an RFC1918 address but the edge terminated a public connection.
- Track anomalous spikes in traffic that appears to originate from allowlisted internal ranges.
- Monitor rate-limiter bypasses where a single upstream source generates disproportionate request volume under many claimed client IPs.
How to Mitigate CVE-2026-90711
Immediate Actions Required
- Upgrade proxy-addr to version 2.0.8 or later across all Node.js services and dependent frameworks such as Express.
- Audit every trust proxy configuration for IPv4-mapped IPv6 subnets and correct any prefix length below 97.
- Rotate any security decisions made using potentially spoofed client IPs, including administrative session grants and rate-limit lockouts.
Patch Information
The issue is fixed in proxy-addr 2.0.8. Update the dependency directly or upgrade parent packages that pin an older version. Verify the resolved version in package-lock.json after installation. Consult the GitHub Security Advisory GHSA-jqcg-44mw-7w3h for the fix commit and version metadata.
Workarounds
- Express any IPv4-mapped IPv6 trust subnet using a prefix length of at least 97, for example ::ffff:10.0.0.0/104 instead of ::ffff:10.0.0.0/8.
- Alternatively, express the trusted range in plain IPv4 notation such as 10.0.0.0/8.
- If the upgrade is delayed, remove IPv4-mapped IPv6 entries from the trust list and rely exclusively on IPv4 CIDR notation until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
