proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-90711 · Microsoft / collected KEV context

EUVD-2026-78300

GHSA-jqcg-44mw-7w3h

cve-program · CVE-2026-90711

• https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-78300

• https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-90711

• https://cna.openjsf.org/security-advisories.html
• https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h

osv · GHSA-jqcg-44mw-7w3h

• https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h
• https://nvd.nist.gov/vuln/detail/CVE-2026-90711
• https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965
• https://cna.openjsf.org/security-advisories.html
• https://github.com/jshttp/proxy-addr
• https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8

• proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an … · Advisory content revised · 11 Nov 2026
• proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an … · Advisory content revised · 9 Nov 2026
• proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an … · Advisory content revised · 7 Nov 2026
• proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an … · Advisory content revised · 5 Nov 2026
• proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an … · Advisory content revised · 1 Nov 2026