Read the docs
TI-2026-61668 Aliases CVE-2026-90711GHSA-jqcg-44mw-7w3h

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Priority MEDIUM 41CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 9 fixed, 16 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-290.

Summary

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This is a fail-open regression introduced in version 1.1.0. The issue is fixed in proxy-addr 2.0.8, and users should upgrade to 2.0.8 or later. As a workaround, ensure any IPv4-mapped IPv6 trust subnet uses a prefix length of at least 97, or express the range in plain IPv4 notation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix Partial proxy-addr (proxy-addr): 2.0.8proxy-addr (npm): 2.0.8Red Hat: 11 advisoriesRed Hat: 9 fixed, 16 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
proxy-addrproxy-addr1.1.0 to before 2.0.82.0.8Patch availableCNA
—proxy-addr (npm)1.1.0 to before 2.0.82.0.8Patch availableGHSA-jqcg-44mw-7w3h
  • proxy-addr Vendorproxy-addr Affected 1.1.0 to before 2.0.8 Fixed in 2.0.8 Patch available CNA
  • proxy-addr (npm) Vendor— Affected 1.1.0 to before 2.0.8 Fixed in 2.0.8 Patch available GHSA-jqcg-44mw-7w3h

Remediation

  • Fix · CNA proxy-addr (proxy-addr) Fixed in 2.0.8
  • Fix · GHSA-jqcg-44mw-7w3h proxy-addr (npm) Fixed in 2.0.8 Advisory →

Red Hat 11 advisories

  • RHSA-2026:95360 Released 2026-11-04 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-storage-rhel9
  • RHSA-2026:95222 Released 2026-11-04 · Red Hat rating Important
    Ansible automation portal Red Hat Enterprise Linux Images
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
  • RHSA-2026:92584 Released 2026-10-29 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
Show 8 more Red Hat advisories
  • RHSA-2026:92578 Released 2026-10-29 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:88198 Released 2026-10-22 · Red Hat rating Important
    Red Hat Developer Hub 1.10.6 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9
  • RHSA-2026:87004 Released 2026-10-21 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-gateway-server-2.6.20261019-1.el9ap, automation-platform-ui-2.6.15-1.el9ap, python3.12-pulpcore-3.49.71-1.el9ap +2
  • RHSA-2026:86957 Released 2026-10-21 · Red Hat rating Important
    Red Hat Developer Hub 1.10.6 Plugin Catalog GA plugins release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki +1
  • RHSA-2026:86675 Released 2026-10-21 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:85846 Released 2026-10-20 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.18 security and bug fix update
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-registry-rhel8, registry.redhat.io/rhmtc/openshift-migration-ui-rhel8 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Ansible Automation Orchestrator 2026AffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Secrets Management Console for Red Hat OpenShiftAffectedNo fix yet
Cryostat 4 on RHEL 9Fixed RHSA-2026:95360
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:86675, RHSA-2026:95222
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:87004
Red Hat Developer Hub 1.10Fixed RHSA-2026:86957, RHSA-2026:88198
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:85846
Red Hat OpenShift AI 3.4Fixed RHSA-2026:92510
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Red Hat Satellite 6.18Fixed RHSA-2026:92584
Red Hat Satellite 6.19Fixed RHSA-2026:92578
Not affected: 24 products
  • Cryostat 4 on RHEL 9
  • OpenShift Lightspeed
  • OpenShift Service Mesh 3
  • Red Hat 3scale API Management Platform 2
  • Red Hat AMQ Broker 7
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1.10
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Hardened Images
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat OpenStack Platform 17.1
  • Red Hat Trusted Artifact Signer
  • Red Hat Trusted Profile Analyzer
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-90711
  2. 2026-10-06 Alias added: GHSA-jqcg-44mw-7w3h
  3. 2026-10-06 Fix available: npm/[email protected] · GHSA-jqcg-44mw-7w3h
  4. 2026-10-06 CVSS score added · GHSA-jqcg-44mw-7w3h
  5. 2026-10-06 Weakness changed · GHSA-jqcg-44mw-7w3h
  6. 2026-10-06 6 new references · GHSA-jqcg-44mw-7w3h
  7. 2026-10-07 Affected versions changed · Red Hat
  8. 2026-10-07 CVSS score added · Red Hat
  9. 2026-10-08 Affected versions changed · Red Hat
  10. 2026-10-09 Affected versions changed · Red Hat
  11. 2026-10-10 Affected versions changed · Red Hat
  12. 2026-10-18 Affected versions changed · Red Hat
  13. 2026-10-20 Fix available: RHSA-2026:85846 · Red Hat
  14. 2026-10-20 Fix available: Red Hat Migration Toolkit 1.8 · Red Hat
  15. 2026-10-21 Fix available: RHSA-2026:86675 · Red Hat
  16. 2026-10-21 Fix available: Red Hat Ansible Automation Platform 2.2 · Red Hat
  17. 2026-10-21 Fix available: RHSA-2026:87004 · Red Hat
  18. 2026-10-21 Fix available: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Red Hat
  19. 2026-10-22 Fix available: RHSA-2026:86957 · Red Hat
  20. 2026-10-22 Fix available: Red Hat Developer Hub 1.10 · Red Hat
  21. 2026-10-23 Fix available: RHSA-2026:88198 · Red Hat
  22. 2026-10-23 Affected versions changed · Red Hat
  23. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  24. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  25. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  26. 2026-10-30 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  27. 2026-10-30 Fix available: Red Hat Satellite 6.18, Red Hat Satellite 6.19 · Red Hat
  28. 2026-10-31 Fix available: RHSA-2026:92578 · Red Hat
  29. 2026-11-03 Fix available: RHSA-2026:92584 · Red Hat
  30. 2026-11-04 Fix available: RHSA-2026:95222 · Red Hat
  31. 2026-11-04 Affected versions changed · Red Hat
  32. 2026-11-05 Fix available: Cryostat 4 on RHEL 9 · Red Hat
  33. 2026-11-05 Affected versions changed · Red Hat
  34. 2026-11-06 Fix available: RHSA-2026:95360 · Red Hat

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences